Log in Start free

Vulnerability · Published Mar 17, 2026 · Assigned by redhat

CVE-2026-4271Libsoup: libsoup: denial of service via use-after-free in http/2 server

Medium 5.3

In plain English

A medium-severity use-after-free in Red Hat Enterprise Linux 10 from Red Hat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.9%top 40.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by sending specially crafted HTTP/2 requests that cause authentication failures. This can lead to the application attempting to access memory that has already been freed, potentially causing application instability or crashes, resulting in a Denial of Service (DoS).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10libsoup33.6.5-3.el10_2.11ALSA-2026:19143
AlmaLinux:10libsoup3-devel3.6.5-3.el10_2.11ALSA-2026:19143
AlmaLinux:10libsoup3-doc3.6.5-3.el10_2.11ALSA-2026:19143
AlmaLinux:10libsoup3-doc3.6.5-3.el10_1.11ALSA-2026:15968
Debian:12libsoup2.4no fix listedDEBIAN-CVE-2026-4271
Debian:13libsoup2.4no fix listedDEBIAN-CVE-2026-4271
Debian:12libsoup3no fix listedDEBIAN-CVE-2026-4271
Debian:13libsoup3no fix listedDEBIAN-CVE-2026-4271
Rocky Linux:10libsoup30:3.6.5-3.el10_1.11RLSA-2026:15968
Ubuntu:22.04:LTSlibsoup2.42.74.2-3ubuntu0.9USN-8890-1
Ubuntu:24.04:LTSlibsoup2.42.74.3-6ubuntu1.9USN-8890-1
Ubuntu:24.04:LTSlibsoup33.4.4-5ubuntu0.9USN-8890-1
Ubuntu:24.04:LTSlibsoup33.4.4-5ubuntu0.9UBUNTU-CVE-2026-4271
Ubuntu:25.10libsoup3no fix listedUBUNTU-CVE-2026-4271
Ubuntu:26.04:LTSlibsoup33.6.6-1ubuntu0.1UBUNTU-CVE-2026-4271
Ubuntu:26.04:LTSlibsoup33.6.6-1ubuntu0.1USN-8890-1
Ubuntu:26.10libsoup33.6.6-1ubuntu3UBUNTU-CVE-2026-4271
Ubuntu:26.10libsoup33.6.6-1ubuntu3USN-8890-2

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References