CVE-2026-85534: Libsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body read
A flaw was found in libsoup. The HTTP/2 client request-body path for non-pollable GInputStream sources buffers an asynchronous read sized to the current flow-control window, then later copies that entire buffer into nghttp2's DATA callback buffer without clamping to the callback length. A malicious HTTP/2 server can send a SETTINGS frame that reduces SETTINGSINITIALWINDOWSIZE while that read is in flight, making the next DATA callback length smaller than the already-buffered byte count. The only check is a gassert(), which aborts the client in typical builds. If assertions are compiled out, nghttp2 rejects a return value larger than the allowed length and fails the session.
Other sources
A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGSINITIALWINDOWSIZE while that buffered read is still in progress. The client then copies the full buffer into a smaller DATA callback without a runtime bounds check, which can abort the process or fail the HTTP/2 session.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Which clients are exposed to this issue?
Clients are exposed when they send an HTTP/2 request body using a non-pollable GInputStream. Exploitation also requires the client to communicate with a malicious HTTP/2 server.
What must the server do to trigger the failure?
The server must reduce SETTINGS_INITIAL_WINDOW_SIZE with a SETTINGS frame while the client has an asynchronous request-body read in flight. This causes the previously buffered data to exceed the size allowed by the subsequent DATA callback.
What is the expected impact in different build configurations?
In typical builds, the g_assert() check aborts the client process, causing a denial of service. If assertions are compiled out, nghttp2 rejects the oversized return value and the HTTP/2 session fails instead.