Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. A flaw was found in libsoup's HTTP/2 protocol parsing logic where processing malformed network frames can trigger a heap buffer over-read condition. Component / Vulnerable Part: libsoup -> HTTP/2 connection processing backend (soup-client-message-io-http2.c or similar HTTP/2 state engine components handling GOAWAY frames). Technical Analysis & Root Cause: When an HTTP/2 session receives a GOAWAY frame, the frame can contain an optional "Additional Debug Data" payload field. The libsoup library erroneously treats this debug data block as a standard, safely NUL-terminated C-string without explicitly verifying the payload length boundaries provided by the framing layer. If a remote peer constructs a malicious GOAWAY frame containing a debug string that lacks a terminating \0 byte within the bounds of the frame allocation, internal string functions will read past the allocated heap space looking for the delimiter. Impact: A remote attacker acting as a malicious HTTP/2 endpoint can transmit a specially crafted GOAWAY frame to read out-of-bounds heap memory. This results in an immediate application crash (Denial of Service) or potential information disclosure of adjacent memory metadata.
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle. Changing version to 45.
Potential upstream fix: https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/548
FEDORA-2026-3f60ccf61f (libsoup3-3.6.6-10.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-3f60ccf61f
FEDORA-2026-ce24b84bb1 (libsoup3-3.7.2-2.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-ce24b84bb1
FEDORA-2026-fce2f41203 (libsoup3-3.6.6-5.fc43) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2026-fce2f41203
FEDORA-2026-3f60ccf61f has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-3f60ccf61f` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-3f60ccf61f See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-ce24b84bb1 has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-ce24b84bb1` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-ce24b84bb1 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-fce2f41203 has been pushed to the Fedora 43 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-fce2f41203` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-fce2f41203 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-3f60ccf61f (libsoup3-3.6.6-10.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2026-fce2f41203 (libsoup3-3.6.6-5.fc43) has been pushed to the Fedora 43 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2026-ce24b84bb1 (libsoup3-3.7.2-2.fc45) has been pushed to the Fedora 45 stable repository. If problem still persists, please make note of it in this bug report.