The soupheadersparse function in soup-headers.c for libsoup HTTP library before 2.2.99 allows remote attackers to cause a denial of service (crash) via malformed HTTP headers, probably involving missing fields or values.
A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skipinsightwhitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server.
A vulnerability was found in the libsoup package. This flaw stems from its failure to correctly verify the termination of multipart HTTP messages. This can allow a remote attacker to send a specially crafted multipart HTTP body, causing the libsoup-consuming server to read beyond its allocated memory boundaries (out-of-bounds read).
A flaw was found in libsoup's HTTP/2 protocol parsing logic where processing malformed network frames can trigger a heap buffer over-read condition.
Component / Vulnerable Part:
libsoup -> HTTP/2 connection processing backend (soup-client-message-io-http2.c or similar HTTP/2 state engine components handling GOAWAY frames).
Technical Analysis & Root Cause:
When an HTTP/2 session receives a GOAWAY frame, the frame can contain an optional "Additional Debug Data" payload field. The libsoup library erroneously treats this debug data block as a standard, safely NUL-terminated C-string without explicitly verifying the payload length boundaries provided by the framing layer. If a remote peer constructs a malicious GOAWAY frame containing a debug string that lacks a terminating \0 byte within the bounds of the frame allocation, internal string functions will read past the allocated heap space looking for the delimiter.
Impact:
A remote attacker acting as a malicious HTTP/2 endpoint can transmit a specially crafted GOAWAY frame to read out-of-bounds heap memory. This results in an immediate application crash (Denial of Service) or potential information disclosure of adjacent memory metadata.
A memory management flaw was discovered in libsoup’s HTTP/2 connection pooling engine that can be weaponized to cause a remote denial of service (DoS).
Component / Vulnerable Part:
libsoup -> HTTP/2 connection state machine (soup-client-message-io-http2.c / stream cleanup logic)
Technical Analysis & Root Cause:
When executing multi-stream HTTP/2 requests, libsoup establishes memory tracking for active data stream windows. A flaw exists in the handling of stream tear-downs or window exhaustion events (such as tracking partial frames or receiving distinct reset signals like RSTSTREAM under specific timing conditions). The internal structure fails to properly free the memory allocated for the stream context or metadata structures upon premature closure. By opening and causing abrupt failures across many concurrent streams, the allocated buffer descriptors remain unfreed in the heap pool.
Impact:
A remote attacker operating a malicious HTTP/2 server can induce a creeping memory leak on the client process. Over multiple continuous requests, this systematic leakage exhausts the application's available memory space, eventually causing a fatal crash due to an Out-of-Memory (OOM) event.