Bug 2500551

Summary:	CVE-2026-15713 libsoup3: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Ganesh <gnaik>
Component:	libsoup3	Assignee:	Adrian Vovk <avovk>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	45	CC:	avovk, gnome-sig, gwync, mcatanza, mcrha
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["0a00681f-0f3f-4107-9861-500fa064c0c7"]}
Fixed In Version:	libsoup3-3.6.6-10.fc44	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-09-08 01:12:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2499941

Description Ganesh 2026-07-14 19:43:20 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A memory management flaw was discovered in libsoup’s HTTP/2 connection pooling engine that can be weaponized to cause a remote denial of service (DoS).

Component / Vulnerable Part:

libsoup -> HTTP/2 connection state machine (soup-client-message-io-http2.c / stream cleanup logic)

Technical Analysis & Root Cause:

When executing multi-stream HTTP/2 requests, libsoup establishes memory tracking for active data stream windows. A flaw exists in the handling of stream tear-downs or window exhaustion events (such as tracking partial frames or receiving distinct reset signals like RST_STREAM under specific timing conditions). The internal structure fails to properly free the memory allocated for the stream context or metadata structures upon premature closure. By opening and causing abrupt failures across many concurrent streams, the allocated buffer descriptors remain unfreed in the heap pool.

Impact:

A remote attacker operating a malicious HTTP/2 server can induce a creeping memory leak on the client process. Over multiple continuous requests, this systematic leakage exhausts the application's available memory space, eventually causing a fatal crash due to an Out-of-Memory (OOM) event.

Comment 1 Aoife Moloney 2026-08-17 15:19:46 UTC

This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.

Comment 2 Milan Crha 2026-09-04 08:18:30 UTC

The CVE number matches, but the description differs. There is a memory leak in both, but here is blamed HTTP/2, while there is blamed SoupCache for it. Either here's a typo in the CVE number or in the description.

Comment 3 Michael Catanzaro 2026-09-04 15:08:01 UTC

Here is what I received from Product Security when I requested the CVEs:

Summary: WebSocket Decompression Bomb: CVE-2026-15709
Summary: WebSocket: Remote DoS via Oversized Control Frame (RFC 6455 §5.5 Violation): CVE-2026-15711
Summary: libsoup HTTP/2 GOAWAY Heap Buffer Over-Read via NUL-Terminated String Assumption: CVE-2026-15712
Summary: Information Disclosure and Cross-User Credential Leak in SoupSession through SoupCache:get_cacheability() in libsoup/cache/soup-cache.c via Header: CVE-2026-15713
Summary: OOB Read on SoupSession through soup_multipart_input_stream_read_headers() in libsoup/soup-multipart-input-stream.c via large Multipart Boundary String: CVE-2026-15714

So the title and description of this issue report is wrong. The CVE metadata is correct.

Comment 4 Fedora Update System 2026-09-05 20:54:48 UTC

FEDORA-2026-3f60ccf61f (libsoup3-3.6.6-10.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-3f60ccf61f

Comment 5 Fedora Update System 2026-09-05 20:55:03 UTC

FEDORA-2026-ce24b84bb1 (libsoup3-3.7.2-2.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-ce24b84bb1

Comment 6 Fedora Update System 2026-09-05 20:55:18 UTC

FEDORA-2026-fce2f41203 (libsoup3-3.6.6-5.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-fce2f41203

Comment 7 Fedora Update System 2026-09-06 00:56:57 UTC

FEDORA-2026-3f60ccf61f has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-3f60ccf61f`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-3f60ccf61f

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Fedora Update System 2026-09-06 01:07:40 UTC

FEDORA-2026-ce24b84bb1 has been pushed to the Fedora 45 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-ce24b84bb1`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-ce24b84bb1

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Fedora Update System 2026-09-06 01:26:55 UTC

FEDORA-2026-fce2f41203 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-fce2f41203`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-fce2f41203

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 10 Fedora Update System 2026-09-08 01:12:22 UTC

FEDORA-2026-3f60ccf61f (libsoup3-3.6.6-10.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.