Description
A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by sending specially crafted HTTP/2 requests that cause authentication failures. This can lead to the application attempting to access memory that has already been freed, potentially causing application instability or crashes, resulting in a Denial of Service (DoS).
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat Enterprise Linux 10
Default version status: affected
0:3.6.5-3.el10_1.11 to < *unaffected
Red Hat Red Hat Enterprise Linux 10
Default version status: affected
0:3.6.5-3.el10_2.11 to < *unaffected
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
Default version status: affected
0:3.6.5-3.el10_0.15 to < *unaffected
Red Hat Red Hat Enterprise Linux 6
Default version status: affected
Red Hat Red Hat Enterprise Linux 7
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 8
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 9
Default version status: unaffected
References
- https://access.redhat.com/errata/RHSA-2026:15968 ↗
- https://access.redhat.com/errata/RHSA-2026:17482 ↗
- https://access.redhat.com/errata/RHSA-2026:19143 ↗
- https://access.redhat.com/security/cve/CVE-2026-4271 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2448044 ↗
- https://gitlab.gnome.org/GNOME/libsoup/-/issues/496 ↗