REDHAT-BUG-2528440: Medium severity libsoup vulnerability
A flaw was found in libsoup. The HTTP/2 client request-body path for non-pollable GInputStream sources buffers an asynchronous read sized to the current flow-control window, then later copies that entire buffer into nghttp2's DATA callback buffer without clamping to the callback length. A malicious HTTP/2 server can send a SETTINGS frame that reduces SETTINGSINITIALWINDOWSIZE while that read is in flight, making the next DATA callback length smaller than the already-buffered byte count. The only check is a gassert(), which aborts the client in typical builds. If assertions are compiled out, nghttp2 rejects a return value larger than the allowed length and fails the session.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Clients using libsoup's HTTP/2 request-body path with a non-pollable GInputStream source are exposed when they communicate with a malicious HTTP/2 server.
What must an attacker do to trigger the failure?
The attacker must control or act as the HTTP/2 server and send a SETTINGS frame that reduces SETTINGS_INITIAL_WINDOW_SIZE while the client has an asynchronous request-body read in flight.
What is the expected impact in different build configurations?
In typical builds, the g_assert() check aborts the client. When assertions are compiled out, nghttp2 rejects the oversized return value and fails the HTTP/2 session instead.