libsoup CVE-2026-85534

Exploitation requires the following specific conditions to align simultaneously: (1) the client must be communicating over HTTP/2, not HTTP/1.x; (2) the HTTP/2 request must include a body provided via a non-pollable GInputStream - a specific GLib I/O stream type that cannot be monitored by polling - causing libsoup to buffer the payload; (3) the client must connect to an attacker-controlled or attacker-influenced HTTP/2 server capable of issuing a SETTINGS frame with a reduced SETTINGS_INITIAL_WINDOW_SIZE; and (4) the server must time this SETTINGS frame while the buffered read is still unresolved. Exploitation is limited by AC:H in the CVSS vector - the server-side timing must be precise. No authentication or special client-side privileges are required. Applications making HTTP/2 requests only to trusted servers, or those using pollable input streams for request bodies, are not affected.

The CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately captures the constrained exploitation surface: triggering the race requires the server to shrink SETTINGS_INITIAL_WINDOW_SIZE at the precise moment between buffer fill and DATA callback execution, making reliable exploitation non-trivial. No EPSS data was provided in the intelligence set, and KEV status is absent - no confirmed active exploitation. The absence of a public proof-of-concept further reduces near-term opportunistic risk, and even a mid-sized municipal IT team in bytom with a diverse RHEL fleet should weight higher-severity, lower-complexity network exposures ahead of this one in their patching queue. The practical victim population is constrained to clients using HTTP/2 (not HTTP/1.x) with non-pollable input streams connecting to servers the attacker controls or can influence - a meaningful but not universal subset of libsoup deployments. The availability-only outcome (process abort) limits business impact compared to RCE-class flaws at similar CVSS scores.

An attacker operates a malicious HTTPS server and lures a client application built on libsoup into making an HTTP/2 POST or PUT request with a body sourced from a non-pollable input stream. Once the client has buffered the request body, the server sends a SETTINGS frame reducing SETTINGS_INITIAL_WINDOW_SIZE below the buffered data size; the client's unchecked copy into the DATA callback then triggers an assertion abort, crashing the application. No proof-of-concept exploit is publicly available, but the attack mechanics are fully describable from RFC 9113 and the referenced source file.