CVE-2026-85197: Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body upload
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file body is being read asynchronously. This can lead to memory corruption, potentially resulting in information disclosure or arbitrary code execution.
Other sources
A heap use-after-free vulnerability exists in libsoup's HTTP/2 client implementation. When a GNOME application sends an HTTP/2 POST request with a file body (using a non-pollable GInputStream such as GFileInputStream), the body data is read asynchronously via ginputstreamreadasync(). If the remote HTTP/2 server sends a GOAWAY frame while this async read is pending, the SoupHTTP2MessageDatastructure is freed through the shutdown path, but the async read callback ondataread() still fires afterward, accessing the freed heap memory.
This is a remotely-triggerable heap use-after-free — a malicious HTTP/2 server (or MITM attacker) can deterministically trigger it when any GNOME application uploads a file over HTTPS with HTTP/2. Affected applications include GNOME Web (Epiphany), GNOME Software, Flatpak, and any GLib-based application using SoupSession for HTTP/2 file uploads.
Impact type: Heap use-after-free (CWE-416) — the freed 168-byte SoupHTTP2MessageData struct is read after free, and the freed datasourcebuffer may also be written to by the still-pending async I/O operation. This constitutes memory corruption with potential for information disclosure or code execution.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which systems and workflows are exposed?
Systems are exposed when a GNOME application uses libsoup’s HTTP/2 client to upload a file over HTTPS, such as an HTTP/2 POST with a file body. The vulnerable path specifically involves a non-pollable GInputStream, including GFileInputStream.
What does an attacker need to trigger the flaw?
An attacker needs to control the HTTP/2 server receiving the upload or be able to act as a man-in-the-middle attacker. They must send an HTTP/2 GOAWAY frame while the client has an asynchronous file-body read pending.
Does exploitation require credentials or user interaction?
No attacker privileges are required. User interaction is required because a GNOME application must initiate a file upload over HTTPS using HTTP/2.
What could successful exploitation cause?
The use-after-free can cause memory corruption. The reported potential impact includes information disclosure or arbitrary code execution, as well as high availability impact.