CVE-2026-85534
Received Received - Intake

HTTP/2 Request Body Buffer Overflow in libsoup

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: redhat-SADP

Description
A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGS_INITIAL_WINDOW_SIZE while that buffered read is still in progress. The client then copies the full buffer into a smaller DATA callback without a runtime bounds check, which can abort the process or fail the HTTP/2 session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85534
EUVD
EUVD-2026-70997

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gnome libsoup From 3.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in libsoup, an HTTP library, specifically affecting its HTTP/2 client implementation. A malicious HTTP/2 server can exploit it by reducing the SETTINGS_INITIAL_WINDOW_SIZE during a deferred body read operation. The client buffers data based on the initial flow-control window but fails to adjust when the window shrinks, causing a buffer overflow in the DATA callback. This leads to a crash or session failure.

Detection Guidance

Detecting this vulnerability requires monitoring for HTTP/2 session failures or crashes in applications using libsoup. Check logs for assertion failures or abnormal terminations in processes linked to libsoup. Use tools like tcpdump or Wireshark to inspect HTTP/2 traffic for SETTINGS_INITIAL_WINDOW_SIZE changes during data transfers.

Impact Analysis

If you use an application relying on libsoup 3.0.0 or later for HTTP/2 requests with non-pollable input streams, a malicious server could disrupt your connection or crash the application. This requires you to connect to an attacker-controlled server using the vulnerable path.

Compliance Impact

This vulnerability primarily impacts system availability by causing client process aborts or HTTP/2 session failures when exploited. It does not directly lead to data breaches or unauthorized access, which are key concerns for GDPR and HIPAA compliance. However, repeated disruptions could affect service reliability, potentially impacting compliance with availability requirements in these regulations.

Mitigation Strategies

Avoid using HTTP/2 uploads from non-pollable input streams to untrusted servers. Update libsoup to a patched version if available. Configure applications to use HTTP/1.1 for uploads to untrusted destinations. Monitor for crashes or session failures in HTTP/2 clients.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85534. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart