Riskcovery

CVE-2026-4271

Libsoup: libsoup: denial of service via use-after-free in http/2 server

State
Published
Severity
5.3 Medium
Published
Mar 17, 2026
Updated
May 19, 2026
Reserved
Mar 16, 2026

Read the record on cve.org

Description

A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by sending specially crafted HTTP/2 requests that cause authentication failures. This can lead to the application attempting to access memory that has already been freed, potentially causing application instability or crashes, resulting in a Denial of Service (DoS).

Scores

CVSSScoreVectorSource
3.15.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lredhat

Weaknesses

Affected Products

ProductVersions
Red Hat Enterprise Linux 10Red Hat
  • 0:3.6.5-3.el10_1.11 and laterNot affected
Red Hat Enterprise Linux 10Red Hat
  • 0:3.6.5-3.el10_2.11 and laterNot affected
Red Hat Enterprise Linux 10.0 Extended Update SupportRed Hat
  • 0:3.6.5-3.el10_0.15 and laterNot affected
Red Hat Enterprise Linux 6Red Hat
    Red Hat Enterprise Linux 7Red Hat
      Red Hat Enterprise Linux 8Red Hat
        Red Hat Enterprise Linux 9Red Hat

          References

          Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.