Search: CVE-2026-85197

CVE-2026-85197 is a heap use-after-free vulnerability in the HTTP/2 client implementation of libsoup3, a GNOME HTTP client library. It can be exploited by a malicious HTTP/2 server or a man-in-the-middle attacker when a GNOME application uploads a file using HTTP/2 and the server sends a GOAWAY frame during asynchronous file body reading. This flaw can cause memory corruption, potentially leading to information disclosure or arbitrary code execution. The vulnerability affects only libsoup3, as libsoup2 does not support HTTP/2 client functionality. No mitigation is currently available that meets Red Hat's criteria for ease of use, deployment, and stability.