Threats Tagged 'cve-2026-85534'

A denial of service vulnerability exists in libsoup 3 HTTP/2 client when uploading a request body from a non-pollable input stream to a malicious HTTP/2 server that reduces the SETTINGS_INITIAL_WINDOW_SIZE during deferred read. This causes excessive buffering and triggers an assertion failure, aborting the client process or dropping the HTTP/2 session. The flaw affects libsoup versions 3.0.0 and later up to certain patched versions.

A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGS_INITIAL_WINDOW_SIZE while that buffered read is still in progress. The client then copies the full buffer into a smaller DATA callback without a runtime bounds check, which can abort the process or fail the HTTP/2 session.

This security update for libsoup addresses two high-severity vulnerabilities: a heap use-after-free in the HTTP/2 client triggered by a GOAWAY frame (CVE-2026-85197), and a heap buffer overflow in SoupSession caused by a crafted SETTINGS frame with an INITIAL_WINDOW_SIZE parameter (CVE-2026-85534). Both vulnerabilities can lead to memory corruption issues.