This vulnerability involves libsoup's HTTP/2 connection tracking framework improperly handling the "Additional Debug Data" payload in GOAWAY frames by assuming it is a null-terminated C-string without strict length verification. A remote attacker can send a malformed GOAWAY frame lacking the null delimiter, causing a heap buffer over-read. This can result in application crashes causing denial of service or potential memory disclosure. The issue affects Red Hat Enterprise Linux 10. The CVSS 3.1 score is 5.9 (medium severity), with network attack vector, high attack complexity, no privileges required, no user interaction, and impact limited to availability.

A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP/2 GOAWAY frame to trigger a heap buffer over-read in libsoup. This can cause the affected application to crash, resulting in denial of service. There is also a potential for partial memory disclosure due to reading beyond buffer boundaries. No confidentiality or integrity impact is confirmed. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-15712 for current remediation guidance. Until a patch or official fix is available, consider limiting exposure of services using libsoup's HTTP/2 functionality to untrusted networks. No vendor advisory states that no action is required or that the issue is already mitigated.