CVE-2026-85534: Reachable Assertion in Red Hat Red Hat Enterprise Linux 10

CVE-2026-85534 is a reachable assertion vulnerability in libsoup 3 HTTP/2 client. When a client sends an HTTP/2 request body from a non-pollable input stream (e.g., GFileInputStream), the library buffers more data than the current flow-control window later permits. A malicious HTTP/2 server can shrink SETTINGS_INITIAL_WINDOW_SIZE during this buffered read. The client then copies the full buffer into a smaller DATA callback without runtime bounds checking, triggering an assertion failure that aborts the client process or fails the HTTP/2 session. Red Hat builds keep GLib assertions enabled, so the typical outcome is a client process abort rather than memory corruption. Exploitation requires the client to connect to a malicious HTTP/2 server and use the vulnerable request-body path. The affected versions are libsoup >= 3.0.0. No official patch or remediation level is currently provided by Red Hat. The vulnerability results in a denial of service (DoS) condition.

The vulnerability causes a denial of service by aborting the client process or dropping the HTTP/2 session when triggered. There is no impact on confidentiality or integrity. Exploitation requires the client to connect to an attacker-controlled HTTP/2 server and use the vulnerable request-body path. The assertion failure prevents memory corruption but results in service disruption.

Red Hat advises not to perform HTTP/2 uploads from non-pollable streams (such as GFileInputStream) to untrusted servers. Using soup_message_set_request_body_from_bytes(), which uses a pollable path, is recommended. Assertions abort the process rather than returning an oversized length, so this is not a fix but a safety mechanism. No official patch or fix is currently available; patch status is not yet confirmed — check the Red Hat advisory for updates.