CVE-2026-85534
Fixed in a distro release EPSS <1%CVSS 5.9
A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGS_INITIAL_WINDOW_SIZE while that buffered read is still in progress. The client then copies the full buffer into a smaller DATA callback without a runtime bounds check, which can abort the process or fail the HTTP/2 session.
Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | libsoup3 | 3.7.2-1.amzn2023 |
| Amazon Linux 2023 | libsoup3-devel | 3.7.2-1.amzn2023 |
| Amazon Linux 2023 | libsoup3-doc | 3.7.2-1.amzn2023 |
| Debian 12 | libsoup3 | no fix |
| Debian 13 | libsoup3 | no fix |
| Debian 14 | libsoup3 | 3.8.0-1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | libsoup | 3.0.4-150400.3.49.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | libsoup | 3.0.4-150400.3.49.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | libsoup | 3.0.4-150400.3.49.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | libsoup | 3.0.4-150400.3.49.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | libsoup | 3.4.4-150600.3.53.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | libsoup | 3.0.4-150400.3.49.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | libsoup | 3.0.4-150400.3.49.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | libsoup | 3.4.4-150600.3.53.1 |
| SUSE Linux Enterprise Server 16.0 | libsoup | 3.6.6-160000.4.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | libsoup | 3.0.4-150400.3.49.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | libsoup | 3.0.4-150400.3.49.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | libsoup | 3.4.4-150600.3.53.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | libsoup | 3.6.6-160000.4.1 |
| SUSE Linux Micro 6.0 | libsoup | 3.4.2-18.1 |
| SUSE Linux Micro 6.1 | libsoup | 3.4.4-slfo.1.1_11.1 |
| SUSE Linux Micro 6.2 | libsoup | 3.6.6-160000.4.1 |
| Ubuntu 22.04 LTS | libsoup2.4 | 2.74.2-3ubuntu0.9 |
| Ubuntu 24.04 LTS | libsoup2.4 | 2.74.3-6ubuntu1.9 |
| Ubuntu 24.04 LTS | libsoup3 | 3.4.4-5ubuntu0.9 |
| Ubuntu 26.04 LTS | libsoup3 | 3.6.6-1ubuntu0.1 |
| Ubuntu 26.10 | libsoup3 | 3.6.6-1ubuntu3 |
| Ubuntu Pro 16.04 LTS | libsoup2.4 | 2.52.2-1ubuntu0.3+esm8 |
| Ubuntu Pro 18.04 LTS | libsoup2.4 | 2.62.1-1ubuntu0.4+esm9 |
| Ubuntu Pro 20.04 LTS | libsoup2.4 | 2.70.0-1ubuntu0.5+esm4 |
| Ubuntu Pro 22.04 LTS | libsoup3 | 3.0.7-0ubuntu1+esm9 |
| Ubuntu Pro 26.04 LTS | libsoup2.4 | 2.74.3-10.1ubuntu5+esm3 |
| openSUSE Leap 16.0 | libsoup | 3.6.6-160000.4.1 |
| openSUSE Tumbleweed | libsoup | 3.6.6-9.1 |