CVE-2026-15712: libsoup HTTP/2 DoS Vulnerability

CVE-2026-15712 Overview

CVE-2026-15712 is a heap buffer over-read vulnerability [CWE-125] in the libsoup HTTP client/server library, affecting versions 3.0 through 3.7.0. The flaw resides in the HTTP/2 connection tracking framework, specifically in how the parser handles the "Additional Debug Data" payload of GOAWAY frames. The library assumes the payload is a NUL-terminated C-string and omits strict length-boundary verification. A remote, unauthenticated attacker can send a malformed GOAWAY frame lacking the null delimiter, causing the parser to read past the allocated buffer. The result is an application crash producing a denial of service, or potentially disclosure of adjacent heap memory contents.

Critical Impact
Remote unauthenticated attackers can crash libsoup-based applications or leak fragments of process memory by sending a single malformed HTTP/2 GOAWAY frame.

Affected Products

libsoup 3.0 through 3.7.0
GNOME desktop applications and services that link against vulnerable libsoup releases
Linux distributions packaging libsoup 3.x (including Red Hat Enterprise Linux ecosystem)

Discovery Timeline

2026-07-14 - CVE-2026-15712 published to the National Vulnerability Database
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15712

Vulnerability Analysis

The defect exists in the libsoup HTTP/2 connection tracking framework. When a peer terminates a connection, HTTP/2 defines the GOAWAY control frame, which may include an optional "Additional Debug Data" field. libsoup parses this field as though it were a standard NUL-terminated C-string. The parser does not verify that the payload length declared in the HTTP/2 frame header matches a properly terminated string before invoking string-handling routines. When an attacker omits the terminating null byte, subsequent read operations continue past the allocated buffer boundary. Depending on the surrounding heap layout, the process either crashes on an inaccessible page or returns adjacent heap bytes to the calling code.

Root Cause

The root cause is missing length-boundary verification when interpreting the GOAWAY frame debug payload. The parser conflates HTTP/2's explicit length-prefixed framing with the C-string convention of null termination. Because HTTP/2 frames use an explicit 24-bit length field and do not guarantee NUL termination in payload data, treating the buffer as a C-string is unsafe. This mismatch between the protocol contract and the parser's assumption produces the out-of-bounds read.

Attack Vector

Exploitation requires network reachability to an HTTP/2 endpoint served or consumed by a vulnerable libsoup client or server. An attacker operating a hostile HTTP/2 server can send a crafted GOAWAY frame to any libsoup-based client that connects, such as GNOME applications performing routine HTTP requests. Conversely, an attacker connecting to a libsoup-based server can attempt the same during connection teardown. No authentication or user interaction is required. The attack complexity is rated High because the attacker must induce the target to establish an HTTP/2 session and control the timing of the malformed frame.

No verified public proof-of-concept code is available at this time. Technical details of the flaw are described in the Red Hat CVE Advisory, the Red Hat Bug Report, and the upstream GNOME Work Item.

Detection Methods for CVE-2026-15712

Indicators of Compromise

Repeated crashes or SIGSEGV signals in processes linking libsoup 3.0 to 3.7.0, particularly during HTTP/2 session teardown
Core dumps referencing libsoup HTTP/2 frame parsing symbols
Unexpected HTTP/2 GOAWAY frames with non-NUL-terminated "Additional Debug Data" payloads observed in packet captures

Detection Strategies

Inventory hosts and containers to identify installed libsoup versions using package managers such as rpm -q libsoup3 or dpkg -l | grep libsoup
Deploy HTTP/2-aware network sensors capable of inspecting GOAWAY frame contents and alerting on malformed debug payloads
Correlate application crash telemetry with outbound HTTP/2 connections to untrusted origins

Monitoring Recommendations

Forward process-crash and systemd-coredump events to a centralized log platform for correlation with network activity
Monitor GNOME desktop and server workloads for repeated restarts of libsoup-dependent services
Track new advisories from Red Hat and the GNOME project for supplementary patches or updated detection guidance

How to Mitigate CVE-2026-15712

Immediate Actions Required

Upgrade libsoup to a fixed release once distributed by your operating system vendor; consult the Red Hat CVE Advisory for RHEL package availability
Restart any long-running services that link libsoup after applying the update to ensure the new library is loaded
Restrict outbound HTTP/2 connections from sensitive workloads to trusted origins where feasible

Patch Information

Refer to the upstream GNOME Work Item 540 for the fix tracking the boundary verification in the HTTP/2 GOAWAY parser. Distribution-specific package updates are tracked in the Red Hat Bug Report. Apply vendor-supplied packages rather than replacing the shared library manually to preserve ABI compatibility with dependent applications.

Workarounds

Disable HTTP/2 negotiation in libsoup-based clients where the application permits, forcing HTTP/1.1 fallback until a patch is applied
Route outbound HTTP traffic through a hardened forward proxy that terminates HTTP/2 and re-emits sanitized requests
Enforce egress filtering to prevent libsoup clients from reaching untrusted HTTP/2 endpoints

bash

# Verify installed libsoup version on RPM-based systems
rpm -q libsoup3

# Verify installed libsoup version on Debian-based systems
dpkg -l | grep libsoup

# Apply distribution updates once available
sudo dnf update libsoup3
sudo apt-get update && sudo apt-get install --only-upgrade libsoup-3.0-0