Log in Start free

Vulnerability · Published Jul 14, 2026 · Assigned by redhat

CVE-2026-15713Libsoup: soupcache: libsoup: http/2 frame window exhaustion remote denial of service via memory leak

Medium 5.9

In plain English

A medium-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.3%top 71.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated attacker acting as a malicious network peer can trick the connection engine into allocating stream states that are subsequently leaked during cleanup. Over a sustained period, this flaw allows the remote attacker to consume the system's heap allocations incrementally, triggering a denial of service (DoS) through an ultimate Out-of-Memory (OOM) application crash.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libsoup2.4no fix listedDEBIAN-CVE-2026-15713
Debian:13libsoup2.4no fix listedDEBIAN-CVE-2026-15713
Debian:12libsoup3no fix listedDEBIAN-CVE-2026-15713
Debian:13libsoup3no fix listedDEBIAN-CVE-2026-15713
Ubuntu:24.04:LTSlibsoup3no fix listedUBUNTU-CVE-2026-15713
Ubuntu:26.04:LTSlibsoup3no fix listedUBUNTU-CVE-2026-15713
Ubuntu:26.10libsoup3no fix listedUBUNTU-CVE-2026-15713

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-772 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References