{"id":"CVE-2026-15712","title":"Soupclientmessageiohttp2: libsoup3: libsoup: http/2 goaway frame parsing heap buffer over-read via invalid nul-termination assumption","summary":"A heap buffer over-read vulnerability was discovered in libsoup's (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the \"Additional Debug Data\"…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-125"],"vendor":"Red Hat","product":"libsoup3","affected":["libsoup3 (all versions)"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-07-14T19:15:34.225845Z"},"exploitAvailable":true,"published":"2026-07-14","updated":"2026-11-06","sourceUpdated":"2026-11-06T17:54:16.248Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-15712","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-15712"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499939","label":"RHBZ#2499939"},{"url":"https://gitlab.gnome.org/GNOME/libsoup/-/work_items/540"}],"tags":["cve.org","exploit-available"],"epss":0.00629,"epssPercentile":0.50418,"ingestedAt":"2026-11-06T18:00:12.494Z","slug":"CVE-2026-15712","body":"## Overview\n\nA heap buffer over-read vulnerability was discovered in libsoup's (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the \"Additional Debug Data\" payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict length-boundary verification before reading this data, a remote, unauthenticated attacker can intentionally send a malformed GOAWAY frame missing the appropriate null delimiter. This causes the library to read past the end of the allocated buffer, triggering an application crash that results in a denial of service (DoS), or potentially exposing fragments of memory contents.\n\n## Affected\n\n- `libsoup3 (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nThe vulnerability requires debug logging to be enabled with the G_MESSAGES_DEBUG environment variable, e.g. G_MESSAGES_DEBUG=all or G_MESSAGES_DEBUG=libsoup-http2. Ensure this environment variable is not set.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}