CVE-2026-85534

A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGS_INITIAL_WINDOW_SIZE while that buffered read is still in progress. The client then copies the full buffer into a smaller DATA callback without a runtime bounds check, which can abort the process or fail the HTTP/2 session.

A libsoup 3 HTTP/2 client can abort or drop the session when it uploads a request body from a non-pollable stream (for example GFileInputStream) to a malicious server that shrinks SETTINGS_INITIAL_WINDOW_SIZE during the deferred read. Red Hat builds keep GLib assertions enabled, so the usual result is a client process abort rather than memory corruption. Exploitation requires the client to connect to an attacker-controlled HTTP/2 endpoint and use that request-body path.

Version affected: libsoup >= 3.0.0

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not HTTP/2-upload from non-pollable streams (e.g. GFileInputStream) to untrusted servers. soup_message_set_request_body_from_bytes() is the pollable path. Assertions abort instead of returning an oversized length; that is not a fix.