CVE-2026-85534: libsoup HTTP/2 Buffer Overflow Vulnerability

CVE-2026-85534 Overview

A flaw exists in libsoup, the HTTP client/server library used by GNOME and many Linux applications. When a client sends an HTTP/2 request body sourced from a non-pollable input stream, the library can buffer more data than the negotiated flow-control window later permits. A malicious HTTP/2 server can shrink SETTINGS_INITIAL_WINDOW_SIZE while the buffered read is still in flight. The client then copies the full buffer into a smaller DATA callback without a runtime bounds check, aborting the process or terminating the HTTP/2 session. The issue is tracked as [CWE-617] Reachable Assertion and affects availability of any application relying on libsoup for outbound HTTP/2 requests.

Critical Impact
A hostile HTTP/2 endpoint can force a client-side abort of any libsoup-based application initiating an HTTP/2 upload from a non-pollable stream.

Affected Products

GNOME libsoup HTTP client library (HTTP/2 client code path in soup-client-message-io-http2.c)
Downstream distributions consuming libsoup (see Red Hat CVE-2026-85534)
Applications linking libsoup for outbound HTTP/2 requests with non-pollable input streams

Discovery Timeline

2026-09-04 - CVE-2026-85534 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85534

Vulnerability Analysis

The flaw resides in the HTTP/2 client message I/O path in libsoup. When the request body originates from a GInputStream that is not pollable, libsoup performs a synchronous read into an internal buffer sized for the current HTTP/2 flow-control window. Between the read and the delivery of that buffer to the nghttp2 DATA source callback, the peer can send a new SETTINGS frame that lowers SETTINGS_INITIAL_WINDOW_SIZE. When the callback fires, the buffered length exceeds the now-smaller window slice the callback is asked to fill. The code copies the buffered data without validating the destination length, tripping an assertion or aborting the HTTP/2 session. Additional context is available in GNOME Libsoup Work Item #551.

Root Cause

The root cause is a missing runtime bounds check between the read-ahead buffer and the flow-control window applicable at DATA callback time. libsoup treats the initial window size as stable for the duration of the buffered read, an assumption HTTP/2 explicitly permits the peer to violate via a mid-stream SETTINGS update. The result is a reachable assertion classified under [CWE-617].

Attack Vector

Exploitation requires a client using libsoup HTTP/2 to send a request body from a non-pollable input stream to an attacker-controlled or attacker-influenced server. The server accepts the stream, then issues a SETTINGS frame that lowers SETTINGS_INITIAL_WINDOW_SIZE before the client submits its buffered DATA frame. The client process aborts or the HTTP/2 session fails, producing a denial-of-service condition against the client application. Confidentiality and integrity are not affected. The relevant client code path is visible in GNOME Libsoup HTTP2 Code.

No public proof-of-concept exploit is listed in the referenced advisories at the time of writing.

Detection Methods for CVE-2026-85534

Indicators of Compromise

Repeated abnormal terminations of processes linking libsoup following outbound HTTP/2 requests
HTTP/2 session reset or GOAWAY frames correlated with peer-initiated SETTINGS frames lowering INITIAL_WINDOW_SIZE
Crash reports or core dumps referencing soup-client-message-io-http2.c frames or nghttp2 DATA callbacks

Detection Strategies

Inventory installed libsoup package versions across Linux hosts and match against the fixed versions listed by the distribution vendor.
Inspect HTTP/2 traffic captures for servers sending SETTINGS frames that reduce INITIAL_WINDOW_SIZE mid-stream during client uploads.
Correlate application crash telemetry with outbound HTTP/2 destinations to identify targeted clients.

Monitoring Recommendations

Enable core dump collection and centralized crash reporting for user-facing applications that depend on libsoup.
Monitor egress HTTP/2 destinations from workstations and servers and alert on connections to untrusted or newly registered domains.
Track process restart counts for services such as GNOME Online Accounts, Evolution, and other libsoup consumers.

How to Mitigate CVE-2026-85534

Immediate Actions Required

Apply the patched libsoup package from your Linux distribution as soon as it is available. Track distribution advisories via Red Hat CVE-2026-85534.
Restart applications and services that link libsoup after upgrading to ensure the new library is loaded.
Limit outbound HTTP/2 connections from sensitive hosts to trusted destinations where operationally feasible.

Patch Information

Refer to the upstream tracking issue GNOME Libsoup Work Item #551 and the vendor advisory at Red Hat Bug Report #2528440 for fix commits and package versions. Deploy the vendor-supplied libsoup update across all Linux endpoints and servers.

Workarounds

Where application design permits, use pollable input streams for HTTP/2 request bodies to avoid the vulnerable read-ahead path.
Restrict libsoup clients to HTTP/1.1 for interactions with untrusted servers until the patched package is deployed.
Apply network egress controls to prevent client applications from reaching untrusted HTTP/2 endpoints.

bash

# Example: verify installed libsoup version on RPM-based systems
rpm -q libsoup libsoup3

# Example: verify installed libsoup version on Debian-based systems
dpkg -l | grep -i libsoup

# Apply vendor updates
sudo dnf update libsoup libsoup3   # Fedora / RHEL
sudo apt update && sudo apt install --only-upgrade libsoup2.4-1 libsoup-3.0-0   # Debian / Ubuntu