CVE-2026-2436: Libsoup: libsoup: denial of service via use-after-free in soupserver during tls handshake

Libsoup: libsoup: denial of service via use-after-free in soupserver during tls handshake

— Microsoft

SoupServer is vulnerable to use after free vulnerability because soupserverdisconnect() frees all SoupServerConnection objects, even if there is a pending GNUTLS handshake to be finished.

A TLS handshake is initiated asynchronously. After creating the SoupServerConnection, libsoup calls gtlsconnectionhandshakeasync(), which registers tlsconnectionhandshakereadycb as a callback. The handshake runs in the background andthe callback fires later when it completes. When the TLS handshake completes successfully, GNUTLS invokes tlsconnectionhandshakereadycb() asynchronously

soupserverdisconnect() is called ( due to some scenario, like a server restart, or other cases). This iterates through all active connections and disconnects them. When the last reference to a SoupServerConnection is dropped, soupserverconnectionfinalize() is called, freeing the object. If the TLS handshake completes after soupserverdisconnect() has freed the connection object, tlsconnectionhandshakereadycb() still fires with a dangling pointer. The callback then calls soupserverconnectionconnected(conn), which attempts to access the freed SoupServerConnection via soupserverconnectiongetiostream(), causing a crash

— Red Hat