This vulnerability in libsoup's HTTP/2 connection tracking framework arises from improper handling of the "Additional Debug Data" payload in GOAWAY frames. The parser assumes the payload is a null-terminated C-string without strict length verification, allowing a remote unauthenticated attacker to send a malformed GOAWAY frame missing the null delimiter. This triggers a heap buffer over-read, causing a denial of service or possible memory disclosure. The affected libsoup versions are 3.0 through 3.7.0, impacting Red Hat Enterprise Linux 10. The CVSS 3.1 base score is 5.9 (medium severity) with network attack vector, high attack complexity, no privileges required, no user interaction, and impact limited to availability.

The vulnerability can be exploited remotely without authentication to cause an application crash resulting in denial of service. There is also a potential for partial memory disclosure due to the out-of-bounds read. No confidentiality or integrity impact is confirmed. The attack complexity is high, reducing the likelihood of exploitation.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-15712 for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, consider restricting exposure of services using libsoup HTTP/2 processing to untrusted networks to reduce risk.