Description

A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGS_INITIAL_WINDOW_SIZE while that buffered read is still in progress. The client then copies the full buffer into a smaller DATA callback without a runtime bounds check, which can abort the process or fail the HTTP/2 session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-04T11:17:19.627Z",
  "pubdate": "2026-09-04T11:17:19.627Z",
  "executiveSummary": "A critical memory safety vulnerability exists in libsoup related to how it handles HTTP/2 request body streaming from non-pollable input sources. The flaw allows a malicious HTTP/2 server to trigger an out-of-bounds copy by manipulating the flow-control window.\nThe vulnerability occurs when the library buffers data from a non-pollable input stream while the server concurrently reduces the SETTINGS_INITIAL_WINDOW_SIZE. This leads to a scenario where the internal buffer exceeds the allowed flow-control window, and the subsequent data copy operation lacks sufficient runtime bounds checking.\nThe primary impact is a crash or forced termination of the application process, potentially leading to a denial-of-service (DoS) condition. As an HTTP/2 protocol implementation, libsoup is exposed to remote, unauthenticated attackers who can craft specific server responses to trigger the condition during the body read process.\nNo authentication or specific privileges are required for an attacker to initiate the exploitation process, provided the client connects to the malicious server. Risk is high for applications utilizing libsoup for HTTP/2 communications, as it compromises session integrity and service availability.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper synchronization and bounds verification logic within the libsoup HTTP/2 stream processing engine. When handling non-pollable input streams, libsoup pre-buffers data to satisfy the protocol's requirements; however, this buffering mechanism operates independently of the dynamic updates to the HTTP/2 flow-control window.\nThe HTTP/2 protocol allows servers to modify the SETTINGS_INITIAL_WINDOW_SIZE at any point during a session. In the vulnerable implementation, the libsoup client initiates a buffered read into memory without adequately accounting for a potential reduction in the receive window by the peer server. If a malicious server intentionally shrinks the SETTINGS_INITIAL_WINDOW_SIZE while a read operation is already in progress, the already buffered data can exceed the new, restricted window size.\nThe exploitation flow proceeds as follows: First, the client initiates an HTTP/2 request to a malicious server. The server responds with settings that initially allow a larger window, inducing the libsoup client to begin buffering the request body from its input stream. Second, before the buffer is processed or transmitted, the malicious server sends a SETTINGS frame reducing the SETTINGS_INITIAL_WINDOW_SIZE. Third, when the client attempts to transition this data into the protocol's DATA callback, the logic fails to perform a secondary, runtime check to verify that the length of the buffered data still adheres to the updated window constraint.\nBecause the memory copy operation lacks strict validation against the updated flow-control limit, the system proceeds with copying the full, oversized buffer into the destination buffer. This leads to an out-of-bounds memory access error. Depending on the memory layout and the severity of the overflow, this result is either an immediate abort of the process (SIGABRT or similar) or a failure of the specific HTTP/2 session, effectively acting as an application-level denial-of-service vulnerability.\nThe vulnerability affects the core HTTP/2 implementation logic within libsoup. Because this is a protocol-level handling error, it is exploitable over any network connection where an application uses libsoup to communicate with an untrusted or compromised HTTP/2 server. There is no mitigation provided by standard user-level authentication or privilege restriction, as the flaw is triggered during the routine negotiation and transmission phase of the HTTP/2 state machine."
}