High severity7.6NVD Advisory· Published Sep 4, 2026· Updated Oct 14, 2026
CVE-2026-85197
CVE-2026-85197
Description
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file body is being read asynchronously. This can lead to memory corruption, potentially resulting in information disclosure or arbitrary code execution.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
6- osv-coords5 versionspkg:rpm/almalinux/libsoup3pkg:rpm/opensuse/libsoup&distro=openSUSE%20Tumbleweedpkg:rpm/almalinux/libsoup3-docpkg:rpm/opensuse/libsoup&distro=openSUSE%20Leap%2016.0pkg:rpm/almalinux/libsoup3-devel
< 3.6.5-3.el10_2.14+ 4 more
- (no CPE)range: < 3.6.5-3.el10_2.14
- (no CPE)range: < 3.6.6-9.1
- (no CPE)range: < 3.6.5-3.el10_2.14
- (no CPE)range: < 3.6.6-160000.4.1
- (no CPE)range: < 3.6.5-3.el10_2.14
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.