CVE-2026-4271
Medium · 5.3CVSS
5.3
EPSS
0.9%
Published
Mar 17, 2026
CISA due date
—
The record
A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by sending specially crafted HTTP/2 requests that cause authentication failures. This can lead to the application attempting to access memory that has already been freed, potentially causing application instability or crashes, resulting in a Denial of Service (DoS).
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | libsoup | 0 | 3.6.6-5.1 |
Related vulnerabilities
- CVE-2026-2708 A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. Also affects libsoup
- CVE-2026-2369 A flaw was found in libsoup. Also affects libsoup
- CVE-2026-2443 A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. Also affects libsoup
- CVE-2026-1761 A flaw was found in libsoup. Also affects libsoup
- CVE-2026-1760 A flaw was found in SoupServer. Also affects libsoup
- CVE-2026-1539 A flaw was found in the libsoup HTTP library that can cause proxy authentication… Also affects libsoup
- CVE-2026-1536 A flaw was found in libsoup. Also affects libsoup
- CVE-2026-1467 A flaw was found in libsoup, an HTTP client library. Also affects libsoup