CVE-2026-15713

A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated attacker acting as a malicious network peer can trick the connection engine into allocating stream states that are subsequently leaked during cleanup. Over a sustained period, this flaw allows the remote attacker to consume the system's heap allocations incrementally, triggering a denial of service (DoS) through an ultimate Out-of-Memory (OOM) application crash.

This flaw poses a moderate availability impact to applications leveraging libsoup for modern HTTP/2 communications. Because the memory leakage accrues iteratively over standard session handling paths, an attacker can reliably cause a service disruption without needing local system privileges or user interaction. Red Hat Product Security notes that while the impact is bounded to a local application process termination, it remains a severe reliability risk for persistent cloud daemons or desktop clients communicating over untrusted wide-area network nodes.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Users should avoid connecting to untrusted HTTP/2 servers. Implementing network egress filtering to restrict outbound connections to only trusted destinations can reduce exposure to this vulnerability.