high 7.6

CVE-2026-85197 json

Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body upload

published 2026-09-04 2 mo ago modified 2026-11-05 4 d ago also EUVD-2026-70953

cvss: 7.6; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits: 0; none known

A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file body is being read asynchronously. This can lead to memory corruption, potentially resulting in information disclosure or arbitrary code execution.

Patch / fix

fixed in 2 distros 6

Red Hat Red Hat Enterprise Linux 10 0:3.6.5-3.el10_2.14
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:3.6.5-3.el10_0.18

ubuntu red hat suse opensuse almalinux azure linux

libsoup3 Ubuntu 24.04 LTS 3.4.4-5ubuntu0.9
libsoup3 Ubuntu 26.10 3.6.6-1ubuntu3
libsoup3 Ubuntu 26.04 LTS 3.6.6-1ubuntu0.1
libsoup3 Ubuntu Pro 22.04 LTS 3.0.7-0ubuntu1+esm9

ubuntu advisories UBUNTU-CVE-2026-85197

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

libsoup3 RHEL 10.2 3.6.5-3.el10_2.14
libsoup3 enterprise linux eus 10.0 3.6.5-3.el10_0.18

red hat advisories RHSA-2026:82728 RHSA-2026:68235

libsoup SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 3.6.6-160000.4.1
libsoup SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 3.0.4-150400.3.49.1
libsoup SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Basesystem 15 SP7 3.4.4-150600.3.53.1
libsoup Linux Micro 6.0 3.4.2-18.1
libsoup Linux Micro 6.1 3.4.4-slfo.1.1_11.1

suse advisories SUSE-SU-2026:23848-1 SUSE-SU-2026:23857-1 SUSE-SU-2026:23866-1 SUSE-SU-2026:4274-1 SUSE-SU-2026:4273-1 SUSE-SU-2026:23875-1

libsoup openSUSE Leap 16.0 3.6.6-160000.4.1
libsoup openSUSE Tumbleweed 3.6.6-9.1

opensuse advisories openSUSE-SU-2026:21901-1 openSUSE-SU-2026:11823-1

libsoup3 AlmaLinux 10 3.6.5-3.el10_2.14

almalinux advisories ALSA-2026:68235

libsoup Azure Linux 3.0 3.4.4-17

azure linux advisories AZL-99915

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-85197 updated 2026-11-04 cvss 7.6

libsoup: libsoup: Heap use-after-free in libsoup HTTP/2 client on_data_read() via GOAWAY during body upload

Red Hat Enterprise Linux AppStream (v. 10) libsoup3 3.6.5-3.el10_2.14
fixed: vendor fix RHSA-2026:68235
Red Hat Enterprise Linux AppStream EUS (v. 10.0) libsoup3 3.6.5-3.el10_0.18
fixed: vendor fix RHSA-2026:82728
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libsoup3-doc 3.6.5-3.el10_2.14
fixed: vendor fix RHSA-2026:68235
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) libsoup3-doc 3.6.5-3.el10_0.18
fixed: vendor fix RHSA-2026:82728
Red Hat Enterprise Linux 6 libsoup Red Hat Enterprise Linux 7 libsoup Red Hat Enterprise Linux 8 libsoup Red Hat Enterprise Linux 9 libsoup
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 2 mo ago (2026-09-04)

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

gitlab.gnome.org https://gitlab.gnome.org/GNOME/libsoup/-/work_items/552 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

Affected products

Red Hat Red Hat Enterprise Linux 10
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
Red Hat Red Hat Enterprise Linux 6
Red Hat Red Hat Enterprise Linux 7
Red Hat Red Hat Enterprise Linux 8
Red Hat Red Hat Enterprise Linux 9

Classification

Weakness

CWE-416 Use After Free

References

gitlab.gnome.org /GNOME/libsoup/-/work_items/552
exploit
access.redhat.com /errata/RHSA-2026:68235
vendor-advisory
access.redhat.com /errata/RHSA-2026:82728
vendor-advisory
access.redhat.com /security/cve/CVE-2026-85197
vdb-entry
bugzilla.redhat.com /show_bug.cgi?id=2528425
issue-tracking

Sources

CVE List CVE-2026-85197
NVD CVE-2026-85197

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary