CVE-2026-85534: Libsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body read

Published Sep 4, 2026
·
Updated

A flaw was found in libsoup. The HTTP/2 client request-body path for non-pollable GInputStream sources buffers an asynchronous read sized to the current flow-control window, then later copies that entire buffer into nghttp2's DATA callback buffer without clamping to the callback length. A malicious HTTP/2 server can send a SETTINGS frame that reduces SETTINGSINITIALWINDOWSIZE while that read is in flight, making the next DATA callback length smaller than the already-buffered byte count. The only check is a gassert(), which aborts the client in typical builds. If assertions are compiled out, nghttp2 rejects a return value larger than the allowed length and fails the session.

Other sources

A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGSINITIALWINDOWSIZE while that buffered read is still in progress. The client then copies the full buffer into a smaller DATA callback without a runtime bounds check, which can abort the process or fail the HTTP/2 session.

MITRE

Affected Software

1 affected component
Gnome libsoup

Event History

Sep 4, 2026
Data Sourced
via Red Hat·08:54 AM
DescriptionSeverityAffected Software
CVE Published
via MITRE·10:19 AM
Data Sourced
via MITRE·10:19 AM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Which clients are exposed to this issue?

Clients are exposed when they send an HTTP/2 request body using a non-pollable GInputStream. Exploitation also requires the client to communicate with a malicious HTTP/2 server.

2

What must the server do to trigger the failure?

The server must reduce SETTINGS_INITIAL_WINDOW_SIZE with a SETTINGS frame while the client has an asynchronous request-body read in flight. This causes the previously buffered data to exceed the size allowed by the subsequent DATA callback.

3

What is the expected impact in different build configurations?

In typical builds, the g_assert() check aborts the client process, causing a denial of service. If assertions are compiled out, nghttp2 rejects the oversized return value and the HTTP/2 session fails instead.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203