CVE-2026-15712Medium· 5.9▾ TwilightPoC availableA heap buffer over-read vulnerability was discovered in libsoup's (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the "Additional Debug Data"…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 32.5 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.6%
A heap buffer over-read vulnerability was discovered in libsoup's (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the "Additional Debug Data" payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict length-boundary verification before reading this data, a remote, unauthenticated attacker can intentionally send a malformed GOAWAY frame missing the appropriate null delimiter. This causes the library to read past the end of the allocated buffer, triggering an application crash that results in a denial of service (DoS), or potentially exposing fragments of memory contents.
libsoup3 (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
The vulnerability requires debug logging to be enabled with the G_MESSAGES_DEBUG environment variable, e.g. G_MESSAGES_DEBUG=all or G_MESSAGES_DEBUG=libsoup-http2. Ensure this environment variable is not set.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-12548Medium· 4.2Libsoup: heap out-of-bounds read in libsoup due to integer truncation
CVE-2026-15714Medium· 6.5Libsoup: soupmultipartinputstream: libsoup: out-of-bounds read in soup_multipart_input_stream_read_headers via an oversized multipart boundary string
CVE-2026-12478Medium· 4.8The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected
CVE-2026-2443Medium· 5.3Libsoup: out-of-bounds read in libsoup handle_partial_get() leading to heap information disclosure
CVE-2026-66337Medium· 6.5Libsoup: libsoup: heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()
CVE-2026-102559High· 8.6A flaw was found in libsoup