libsoup HTTP/2 Heap UAF Arb. Code Exec
CVE-2026-85197 Published on September 4, 2026
Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body upload
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file body is being read asynchronously. This can lead to memory corruption, potentially resulting in information disclosure or arbitrary code execution.
Vulnerability Analysis
CVE-2026-85197 can be exploited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2026-85197. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and a high impact on availability.
Timeline
Reported to Red Hat.
Made public.
Weakness Type
What is a Dangling pointer Vulnerability?
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
CVE-2026-85197 has been classified to as a Dangling pointer vulnerability or weakness.
Products Associated with CVE-2026-85197
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-85197 are published in these products:
Affected Versions
Red Hat Enterprise Linux 10:- Version 0:3.6.5-3.el10_2.14 and below * is unaffected.
- Version 0:3.6.5-3.el10_0.18 and below * is unaffected.