Bug 2500549

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A memory management flaw was discovered in libsoup’s HTTP/2 connection pooling engine that can be weaponized to cause a remote denial of service (DoS).

Component / Vulnerable Part:

libsoup -> HTTP/2 connection state machine (soup-client-message-io-http2.c / stream cleanup logic)

Technical Analysis & Root Cause:

When executing multi-stream HTTP/2 requests, libsoup establishes memory tracking for active data stream windows. A flaw exists in the handling of stream tear-downs or window exhaustion events (such as tracking partial frames or receiving distinct reset signals like RST_STREAM under specific timing conditions). The internal structure fails to properly free the memory allocated for the stream context or metadata structures upon premature closure. By opening and causing abrupt failures across many concurrent streams, the allocated buffer descriptors remain unfreed in the heap pool.

Impact:

A remote attacker operating a malicious HTTP/2 server can induce a creeping memory leak on the client process. Over multiple continuous requests, this systematic leakage exhausts the application's available memory space, eventually causing a fatal crash due to an Out-of-Memory (OOM) event.