CVE-2026-4271
Gnome Libsoup: use-after-free can lead to denial of service
- Risk score
- 72/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.9%
- Published
- 17 Mar 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A Use-After-Free vulnerability in libsoup's HTTP/2 server implementation allows a remote attacker to cause application instability or crashes, resulting in a Denial of Service (DoS), by sending specially crafted HTTP/2 requests.
- Affected
- {'products': ['libsoup'], 'packages': [], 'versions': []}
- Fix
- Check the linked advisory for details on the fix.
- Exploitation
- Public proof of concept
Why it is Amber
- CVSS 7.5 high
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
- Named in a government or vendor bulletin
Government and vendor bulletins
References
- https://ubuntu.com/security/notices/USN-8890-2
- https://access.redhat.com/errata/RHSA-2026:15968
- https://access.redhat.com/errata/RHSA-2026:17482
- https://access.redhat.com/errata/RHSA-2026:19143
- https://access.redhat.com/security/cve/CVE-2026-4271
- https://bugzilla.redhat.com/show_bug.cgi?id=2448044
- https://gitlab.gnome.org/GNOME/libsoup/-/issues/496
- https://gitlab.gnome.org/GNOME/libsoup/-/issues/496
Original description
A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by sending specially crafted HTTP/2 requests that cause authentication failures. This can lead to the application attempting to access memory that has already been freed, potentially causing application instability or crashes, resulting in a Denial of Service (DoS).
Last activity 21 Oct 2026. Patch Forecast updates every hour.