A memory management flaw was discovered in libsoup’s HTTP/2 connection pooling engine that can be weaponized to cause a remote denial of service (DoS).

Component / Vulnerable Part:

libsoup -> HTTP/2 connection state machine (soup-client-message-io-http2.c / stream cleanup logic)

Technical Analysis & Root Cause:

When executing multi-stream HTTP/2 requests, libsoup establishes memory tracking for active data stream windows. A flaw exists in the handling of stream tear-downs or window exhaustion events (such as tracking partial frames or receiving distinct reset signals like RST_STREAM under specific timing conditions). The internal structure fails to properly free the memory allocated for the stream context or metadata structures upon premature closure. By opening and causing abrupt failures across many concurrent streams, the allocated buffer descriptors remain unfreed in the heap pool.

Impact:

A remote attacker operating a malicious HTTP/2 server can induce a creeping memory leak on the client process. Over multiple continuous requests, this systematic leakage exhausts the application's available memory space, eventually causing a fatal crash due to an Out-of-Memory (OOM) event.