CVE-2026-15713

Deferred Deferred - Pending Action

Heap Memory Leak in libsoup HTTP/2 Implementation

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: Red Hat, Inc.

Description

A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated attacker acting as a malicious network peer can trick the connection engine into allocating stream states that are subsequently leaked during cleanup. Over a sustained period, this flaw allows the remote attacker to consume the system's heap allocations incrementally, triggering a denial of service (DoS) through an ultimate Out-of-Memory (OOM) application crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-03

NVD

CVE-2026-15713

EUVD

EUVD-2026-44429

Affected Vendors & Products

Vendor	Product	Version / Range
gnome	libsoup	*
libsoup	libsoup	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-772	The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

Attack-Flow Graph

Executive Summary

This vulnerability is in libsoup's HTTP/2 implementation where memory blocks are not properly released during stream termination. A remote attacker can exploit this by sending malicious HTTP/2 requests to cause memory leaks, leading to a denial of service through an Out-of-Memory crash.

Detection Guidance

Monitor memory usage on systems running libsoup with HTTP/2 enabled. Check for gradual heap exhaustion or OOM conditions during HTTP/2 traffic. Use tools like 'top', 'htop', or 'vmstat' to track memory consumption. Inspect logs for HTTP/2 stream reset or window exhaustion events.

Impact Analysis

An attacker could send malicious HTTP/2 requests to gradually consume system memory, leading to application crashes or system instability due to memory exhaustion. This could disrupt services relying on libsoup for HTTP/2 communication.

Compliance Impact

This vulnerability could lead to service disruptions or crashes, potentially violating availability requirements in GDPR or HIPAA. However, no direct data exposure is mentioned, so confidentiality impacts are unlikely.

Mitigation Strategies

Update libsoup to the latest patched version. Disable HTTP/2 support if not required. Implement rate limiting for HTTP/2 connections. Monitor memory usage closely for signs of exhaustion.

Hi! I’m here to help you understand CVE-2026-15713. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70