CVE-2026-15712

Name	CVE-2026-15712
Description	A heap buffer over-read vulnerability was discovered in libsoup's (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the "Additional Debug Data" payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict length-boundary verification before reading this data, a remote, unauthenticated attacker can intentionally send a malformed GOAWAY frame missing the appropriate null delimiter. This causes the library to read past the end of the allocated buffer, triggering an application crash that results in a denial of service (DoS), or potentially exposing fragments of memory contents.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1142841

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libsoup2.4 (PTS)	bullseye	2.72.0-2	fixed
	bullseye (security)	2.72.0-2+deb11u3	fixed
	bookworm	2.74.3-1+deb12u1	fixed
	trixie	2.74.3-10.1	vulnerable
libsoup3 (PTS)	bookworm	3.2.3-0+deb12u2	vulnerable
	trixie	3.6.5-3	vulnerable
	forky, sid	3.6.6-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
libsoup2.4	source	bullseye	(not affected)
libsoup2.4	source	bookworm	(not affected)
libsoup2.4	source	(unstable)	(unfixed)
libsoup3	source	(unstable)	(unfixed)	1142841

Notes

[bookworm] - libsoup2.4 <not-affected> (HTTP/2 support is libsoup3-only, libsoup 2.x has no HTTP/2 implementation)
[bullseye] - libsoup2.4 <not-affected> (HTTP/2 support is libsoup3-only, libsoup 2.x has no HTTP/2 implementation)
https://bugzilla.redhat.com/show_bug.cgi?id=2499939
https://gitlab.gnome.org/GNOME/libsoup/-/work_items/540