Description

A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file body is being read asynchronously. This can lead to memory corruption, potentially resulting in information disclosure or arbitrary code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-09-04T08:17:16.677Z",
  "pubdate": "2026-09-04T08:17:16.677Z",
  "executiveSummary": "A critical heap use-after-free vulnerability exists in the libsoup HTTP/2 client implementation. The flaw is triggered when an application performing an asynchronous file upload receives a GOAWAY frame from a malicious or compromised HTTP/2 server.\nThis vulnerability allows for potential memory corruption, which may result in unauthorized information disclosure or arbitrary code execution within the context of the affected GNOME application.\nThe attack is network-exploitable, requiring the attacker to act as either a malicious HTTP/2 server or a Man-in-the-Middle (MITM) capable of intercepting and injecting traffic during the upload process.\nDue to the nature of use-after-free conditions in asynchronous request handling, the risk is considered high, as it could lead to reliable exploitation of memory management errors to hijack the process control flow.\nNo authentication is required for an attacker to initiate this exploit, provided they can influence the communication stream during an active HTTP/2 file upload initiated by a vulnerable libsoup-based client.",
  "technicalDetails": "The vulnerability resides in the libsoup HTTP/2 asynchronous request handling logic. Specifically, the flaw occurs during the state transition following the receipt of an HTTP/2 GOAWAY frame while an asynchronous file upload operation is in progress.\nThe root cause is a race condition or improper state management when the client receives an asynchronous shutdown signal (GOAWAY) from the server. When the server signals the connection termination, libsoup attempts to clean up the HTTP/2 stream state while the asynchronous read operation for the request body is still actively referencing the stream's memory structures.\nThe attack flow proceeds as follows: 1) The client initiates an asynchronous file upload via HTTP/2. 2) The attacker sends a GOAWAY frame to signal the termination of the HTTP/2 connection. 3) The client's connection management logic invokes cleanup routines, freeing the memory associated with the HTTP/2 stream and its associated request context. 4) The ongoing asynchronous file reading process, unaware that the stream context has been deallocated, attempts to access the already freed heap memory.\nBecause the memory is freed but still referenced by the asynchronous callback or the request body reader, the application enters a use-after-free state. A sophisticated attacker can leverage heap grooming techniques—such as spraying the heap with controlled data—to occupy the deallocated memory location with a malicious payload.\nWhen the dangling pointer is subsequently dereferenced by the file reader, the application may execute attacker-controlled instructions or leak sensitive memory contents that occupied the heap region prior to the re-allocation. This memory corruption can bypass standard process protections if the heap layout can be reliably manipulated.\nSince libsoup is a fundamental library for many GNOME applications, any software utilizing the affected versions for HTTP/2 communications is exposed. The vulnerability does not require local access, as the trigger is entirely network-based, making MITM attacks a viable vector for exploitation if the communication channel is not appropriately secured with verified TLS, although the HTTP/2 protocol implementation itself remains the primary point of failure.\nThe post-exploitation impact includes arbitrary code execution with the permissions of the user running the GNOME application, potentially leading to full system compromise or persistence, depending on the application's privilege level and sandboxing constraints."
}