libsoup CVE-2026-15712

The target application must use libsoup to handle HTTP/2 connections - HTTP/2 must be negotiated between client and server (not HTTP/1.1). The vulnerable code path is triggered specifically when a GOAWAY frame with an Additional Debug Data payload is received; the attacker must be in a position to deliver this frame, either as a malicious server to a libsoup-based HTTP/2 client, or as a client sending GOAWAY to a libsoup-based HTTP/2 server. The CVSS AC:H rating indicates reliable triggering requires non-trivial crafting precision. Exploitation is limited by: high attack complexity (non-automatable per SSVC), the requirement that HTTP/2 be in use (not a default-on guarantee for all libsoup deployments), and the requirement for network access to a service or client using libsoup for HTTP/2. No authentication is required once network access is established.

CVSS 5.9 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H reflects a network-reachable, unauthenticated path but with high attack complexity - consistent with the SSVC Automatable:no rating, which signals that reliable, unsupervised exploitation requires non-trivial frame crafting. The CVSS Technical Impact is partial (scope unchanged, availability-only). A notable discrepancy exists: the official CVSS rates C:N (no confidentiality impact), yet the CVE description explicitly states the over-read may expose 'fragments of memory contents,' implying potential confidentiality impact. This conflict should be verified with the Red Hat Security Team via https://access.redhat.com/security/cve/CVE-2026-15712. SSVC confirms a POC exists, elevating practical concern beyond a purely theoretical finding, but absence from CISA KEV and the non-automatable rating indicate this is not currently being mass-exploited. Real-world priority is moderate: high for RHEL 10 deployments where libsoup-based applications face untrusted HTTP/2 traffic (e.g., GNOME Web, GNOME Online Accounts, or custom services); lower for desktop-only deployments where network exposure is limited.

An attacker operating a malicious HTTP/2 server (or performing a man-in-the-middle position against a libsoup-based client) sends a GOAWAY frame whose Additional Debug Data field contains binary content with no NUL terminator. When libsoup's parser processes the frame, it calls a string function on the raw payload, reading past the allocated buffer until a NUL byte is found elsewhere in heap memory, crashing the application or leaking heap contents to the attacker. A proof-of-concept demonstrating this behavior exists per SSVC data, though reliable exploitation requires precise frame construction to control read length.