CVE-2026-15713: libsoup HTTP/2 Memory Leak DoS Vulnerability

CVE-2026-15713 Overview

CVE-2026-15713 is a memory leak vulnerability [CWE-772] in the HTTP/2 protocol implementation of libsoup, a GNOME HTTP client and server library. The library fails to release memory context blocks when HTTP/2 streams terminate under specific conditions, including window exhaustion and explicit stream resets. A remote, unauthenticated attacker can repeatedly trigger these conditions as a malicious network peer. Sustained exploitation gradually exhausts heap allocations until the target process crashes with an out-of-memory (OOM) condition. The flaw affects availability only and requires no authentication or user interaction.

Critical Impact
Remote unauthenticated attackers can cause a denial of service by exhausting heap memory in any application linking against a vulnerable libsoup version.

Affected Products

GNOME libsoup HTTP/2 implementation
Red Hat Enterprise Linux packages linking libsoup (see Red Hat CVE-2026-15713 Advisory)
Applications and services depending on libsoup for HTTP/2 client or server functionality

Discovery Timeline

2026-07-14 - CVE-2026-15713 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15713

Vulnerability Analysis

The vulnerability resides in libsoup's HTTP/2 connection engine. When an HTTP/2 stream terminates through window exhaustion or an explicit RST_STREAM frame, the library allocates stream state structures but fails to free the associated memory context blocks during cleanup. Each malformed or abruptly terminated stream leaks a small amount of heap memory. An attacker acting as a malicious peer can open and terminate streams repeatedly over a sustained period. The cumulative leak eventually consumes all available heap, forcing the target process into an OOM crash. The impact is limited to availability, with no confidentiality or integrity consequences.

Root Cause

The root cause is missing release of a memory context block during specific HTTP/2 stream cleanup paths, classified as [CWE-772] Missing Release of Resource after Effective Lifetime. The cleanup routine handles normal stream closure correctly but omits the deallocation step when streams end via flow-control window exhaustion or peer-initiated resets. See the GNOME Work Item #541 for tracking details.

Attack Vector

The attack requires network access to a service that uses libsoup for HTTP/2 communication. An attacker establishes an HTTP/2 connection and repeatedly opens streams that terminate through the vulnerable code paths. The attacker can either send RST_STREAM frames to abort streams or manipulate flow-control windows to force exhaustion. Each iteration leaks memory. High attack complexity reflects the need to sustain the pattern over time and the environmental factors that influence memory pressure. No credentials or user interaction are needed. The vulnerability manifests in the HTTP/2 stream cleanup path; see the Red Hat Bug Report #2499941 for technical discussion.

Detection Methods for CVE-2026-15713

Indicators of Compromise

Steadily increasing resident set size (RSS) of processes linking libsoup without a corresponding increase in legitimate workload
Application crash logs referencing OOM conditions or glib allocation failures in libsoup-based services
Elevated volume of HTTP/2 RST_STREAM frames from a single remote peer
Repeated HTTP/2 stream open and abort sequences targeting the same connection

Detection Strategies

Monitor process memory growth for services that use libsoup and alert on sustained upward trends
Inspect HTTP/2 traffic for abnormal ratios of stream resets to completed requests
Correlate OOM killer events in system logs with network activity toward libsoup-based endpoints

Monitoring Recommendations

Enable memory usage telemetry from endpoint and server agents and forward it to a centralized data lake for trending
Deploy network traffic analysis to flag HTTP/2 sessions with anomalous stream lifecycle patterns
Alert on repeated service restarts of applications that link libsoup

How to Mitigate CVE-2026-15713

Immediate Actions Required

Inventory all systems and applications that link libsoup, including desktop and server components
Apply vendor-supplied libsoup updates as soon as they are available through your distribution's package manager
Restart long-running services that use libsoup after patching to clear any accumulated leaked memory
Restrict exposure of libsoup-based HTTP/2 endpoints to trusted networks where feasible

Patch Information

Refer to the Red Hat CVE-2026-15713 Advisory for package updates and errata. Upstream fix progress is tracked in GNOME Work Item #541. Distribution maintainers should rebuild dependent packages after libsoup is updated.

Workarounds

Place a reverse proxy or HTTP/2-aware gateway in front of libsoup-based services to terminate and normalize HTTP/2 sessions
Enforce connection limits and rate limiting on HTTP/2 stream creation and reset frames per source
Configure service managers such as systemd with MemoryMax limits and automatic restart policies to contain leaks until patching completes

bash

# Configuration example: systemd unit hardening for a libsoup-based service
[Service]
MemoryMax=512M
Restart=on-failure
RestartSec=5s