https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 00:04:29 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-336745 EUVD-2026-336745 https://cve.radiocsirt.org/vuln/euvd-2026-336745 https://cve.radiocsirt.org/vuln/fkie_cve-2026-15712 <p>A heap buffer over-read vulnerability was discovered in libsoup&#39;s (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the &#34;Additional Debug Data&#34; payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict length-boundary verification before reading this data, a remote, unauthenticated attacker can intentionally send a malformed GOAWAY frame missing the appropriate null delimiter. This causes the library to read past the end of the allocated buffer, triggering an application crash that results in a denial of service (DoS), or potentially exposing fragments of memory contents.</p> <p>A heap buffer over-read vulnerability was discovered in libsoup&#39;s (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the &#34;Additional Debug Data&#34; payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict length-boundary verification before reading this data, a remote, unauthenticated attacker can intentionally send a malformed GOAWAY frame missing the appropriate null delimiter. This causes the library to read past the end of the allocated buffer, triggering an application crash that results in a denial of service (DoS), or potentially exposing fragments of memory contents.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-15712 https://cve.radiocsirt.org/vuln/ghsa-9fmg-hf32-22c3 <p>A heap buffer over-read vulnerability was discovered in libsoup&#39;s (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the &#34;Additional Debug Data&#34; payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict length-boundary verification before reading this data, a remote, unauthenticated attacker can intentionally send a malformed GOAWAY frame missing the appropriate null delimiter. This causes the library to read past the end of the allocated buffer, triggering an application crash that results in a denial of service (DoS), or potentially exposing fragments of memory contents.</p> <p>A heap buffer over-read vulnerability was discovered in libsoup&#39;s (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the &#34;Additional Debug Data&#34; payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict length-boundary verification before reading this data, a remote, unauthenticated attacker can intentionally send a malformed GOAWAY frame missing the appropriate null delimiter. This causes the library to read past the end of the allocated buffer, triggering an application crash that results in a denial of service (DoS), or potentially exposing fragments of memory contents.</p> https://cve.radiocsirt.org/vuln/ghsa-9fmg-hf32-22c3 https://cve.radiocsirt.org/vuln/msrc_cve-2026-15712 msrc_CVE-2026-15712 https://cve.radiocsirt.org/vuln/msrc_cve-2026-15712 https://cve.radiocsirt.org/vuln/oesa-2026-4006 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: libsoup3</p> <p>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. Security Fix(es):</p> <p>A flaw was found in libsoup&amp;apos;s WebSocket implementation when using the permessage-deflate extension. The extension&amp;apos;s decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via max_incoming_payload_size, it fails to track or limit memory allocation during decompression. A separate check for decompressed size (max_total_message_size) exists but executes only after inflation is complete, and it is entirely disabled by default for client connections. A remote, unauthenticated attacker can exploit this by sending a small, highly compressed payload (a decompression bomb), causing unbounded memory allocation that triggers an Out-of-Memory (OOM) crash and a Denial of Service (DoS).(CVE-2026-15709)</p> <p>A heap buffer over-read vulnerability was discovered in libsoup&amp;apos;s (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the &amp;quot;Additional Debug Data&amp;quot; payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict length-boundary verification before reading this data, a remote, un…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: libsoup3</p> <p>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. Security Fix(es):</p> <p>A flaw was found in libsoup&amp;apos;s WebSocket implementation when using the permessage-deflate extension. The extension&amp;apos;s decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via max_incoming_payload_size, it fails to track or limit memory allocation during decompression. A separate check for decompressed size (max_total_message_size) exists but executes only after inflation is complete, and it is entirely disabled by default for client connections. A remote, unauthenticated attacker can exploit this by sending a small, highly compressed payload (a decompression bomb), causing unbounded memory allocation that triggers an Out-of-Memory (OOM) crash and a Denial of Service (DoS).(CVE-2026-15709)</p> <p>A heap buffer over-read vulnerability was discovered in libsoup&amp;apos;s (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the &amp;quot;Additional Debug Data&amp;quot; payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict length-boundary verification before reading this data, a remote, un…</p> https://cve.radiocsirt.org/vuln/oesa-2026-4006 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-15712 <p><strong>Affected:</strong> Ubuntu:Pro:22.04:LTS: libsoup3, Ubuntu:24.04:LTS: libsoup3, Ubuntu:26.04:LTS: libsoup3</p> <p>A heap buffer over-read vulnerability was discovered in libsoup&#39;s (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the &#34;Additional Debug Data&#34; payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict length-boundary verification before reading this data, a remote, unauthenticated attacker can intentionally send a malformed GOAWAY frame missing the appropriate null delimiter. This causes the library to read past the end of the allocated buffer, triggering an application crash that results in a denial of service (DoS), or potentially exposing fragments of memory contents.</p> <p><strong>Affected:</strong> Ubuntu:Pro:22.04:LTS: libsoup3, Ubuntu:24.04:LTS: libsoup3, Ubuntu:26.04:LTS: libsoup3</p> <p>A heap buffer over-read vulnerability was discovered in libsoup&#39;s (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the &#34;Additional Debug Data&#34; payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict length-boundary verification before reading this data, a remote, unauthenticated attacker can intentionally send a malformed GOAWAY frame missing the appropriate null delimiter. This causes the library to read past the end of the allocated buffer, triggering an application crash that results in a denial of service (DoS), or potentially exposing fragments of memory contents.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-15712