CVE catalog

CVE-2026-4271

A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by send

[CVE catalog]

Severity
High · CVSS 8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.86% · Oct 25, 2026

A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by sending specially crafted HTTP/2 requests that cause authentication failures. This can lead to the application attempting to access memory that has already been freed, potentially causing application instability or crashes, resulting in a Denial of Service (DoS).

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibsoup3sid3.8.0-3fixed
Debianlibsoup3forky3.8.0-3fixed
Debianlibsoup3trixie3.6.5-3vulnerable
Debianlibsoup3bookworm3.2.3-0+deb12u2vulnerable
Debianlibsoup2.4trixie2.74.3-10.1vulnerable
Debianlibsoup2.4bookworm2.74.3-1+deb12u1vulnerable
Cpelibsoup2.4Not reportedNot reportedvulnerable
Cpelibsoup3Not reportedNot reportedvulnerable
Ubuntulibsoup2.4noble2.74.3-6ubuntu1.9fixed
Ubuntulibsoup3noble3.4.4-5ubuntu0.9fixed
Ubuntugir1.2-soup-2.4noble2.74.3-6ubuntu1.9fixed
Ubuntugir1.2-soup-3.0noble3.4.4-5ubuntu0.9fixed
Ubuntulibsoup-2.4-1noble2.74.3-6ubuntu1.9fixed
Ubuntulibsoup-3.0-0noble3.4.4-5ubuntu0.9fixed
Ubuntulibsoup-3.0-commonnoble3.4.4-5ubuntu0.9fixed
Ubuntulibsoup-3.0-devnoble3.4.4-5ubuntu0.9fixed
Ubuntulibsoup-3.0-docnoble3.4.4-5ubuntu0.9fixed
Ubuntulibsoup-3.0-testsnoble3.4.4-5ubuntu0.9fixed
Ubuntulibsoup-gnome-2.4-1noble2.74.3-6ubuntu1.9fixed
Ubuntulibsoup-gnome2.4-devnoble2.74.3-6ubuntu1.9fixed
Ubuntulibsoup2.4-commonnoble2.74.3-6ubuntu1.9fixed
Ubuntulibsoup2.4-devnoble2.74.3-6ubuntu1.9fixed
Ubuntulibsoup2.4-docnoble2.74.3-6ubuntu1.9fixed
Ubuntulibsoup2.4-testsnoble2.74.3-6ubuntu1.9fixed
Ubuntulibsoup2.4pro2.74.3-10.1ubuntu4vulnerable
Ubuntulibsoup2.4pro2.74.3-10.1ubuntu5vulnerable
Ubuntulibsoup2.4pro2.74.3-10.1ubuntu5+esm1vulnerable
Ubuntulibsoup2.4pro2.74.3-10.1ubuntu5+esm2vulnerable
Ubuntulibsoup2.4pro2.74.3-10.1ubuntu5+esm3fixed
Ubuntulibsoup2.422.042.72.0-3ubuntu3vulnerable
Ubuntulibsoup2.422.042.74.1-1vulnerable
Ubuntulibsoup2.422.042.74.2-2vulnerable
Ubuntulibsoup2.422.042.74.2-3vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.1vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.2vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.3vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.4vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.5vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.6vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.7vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.8vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.9fixed
Ubuntulibsoup3pro3.0.4-2vulnerable
Ubuntulibsoup3pro3.0.4-3vulnerable
Ubuntulibsoup3pro3.0.5-1vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm1vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm2vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm3vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm4vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm5vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm6vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm7vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm8vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm9fixed
Ubuntulibsoup2.424.042.74.3-1vulnerable
Ubuntulibsoup2.424.042.74.3-2vulnerable
Ubuntulibsoup2.424.042.74.3-3vulnerable
Ubuntulibsoup2.424.042.74.3-6vulnerable
Ubuntulibsoup2.424.042.74.3-6build1vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.1vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.2vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.3vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.4vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.5vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.6vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.7vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.8vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.9fixed
Ubuntulibsoup324.043.4.2-4vulnerable
Ubuntulibsoup324.043.4.4-1vulnerable
Ubuntulibsoup324.043.4.4-2vulnerable
Ubuntulibsoup324.043.4.4-4vulnerable
Ubuntulibsoup324.043.4.4-5vulnerable
Ubuntulibsoup324.043.4.4-5build1vulnerable
Ubuntulibsoup324.043.4.4-5build2vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.1vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.2vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.3vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.4vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.5vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.6vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.7vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.8vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.9fixed
Ubuntulibsoup326.043.6.5-4vulnerable
Ubuntulibsoup326.043.6.5-5vulnerable
Ubuntulibsoup326.043.6.5-6vulnerable
Ubuntulibsoup326.043.6.5-7vulnerable
Ubuntulibsoup326.043.6.5-9vulnerable
Ubuntulibsoup326.043.6.6-1vulnerable
Ubuntulibsoup326.043.6.6-1ubuntu0.1fixed
Suselibsouplinux enterprise server 16.03.6.6-160000.2.1fixed
Suselibsouplinux enterprise server for sap applications 16.03.6.6-160000.2.1fixed
Opensuselibsouptumbleweed3.6.6-5.1fixed
Ubuntulibsoup326.103.6.6-1vulnerable
Ubuntulibsoup326.103.6.6-1ubuntu3fixed
Ubuntulibsoup324.043.4.2-4vulnerable
Ubuntulibsoup324.043.4.4-1vulnerable
Ubuntulibsoup324.043.4.4-2vulnerable
Ubuntulibsoup324.043.4.4-4vulnerable
Ubuntulibsoup324.043.4.4-5vulnerable
Ubuntulibsoup324.043.4.4-5build1vulnerable
Ubuntulibsoup324.043.4.4-5build2vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.1vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.2vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.3vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.4vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.5vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.6vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.7vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.8vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.9fixed
Ubuntulibsoup325.103.6.5-1vulnerable
Ubuntulibsoup325.103.6.5-1ubuntu1vulnerable
Ubuntulibsoup325.103.6.5-3vulnerable
Ubuntulibsoup325.103.6.5-4vulnerable
Ubuntulibsoup325.103.6.5-4ubuntu0.1vulnerable
Ubuntulibsoup325.103.6.5-4ubuntu0.2vulnerable
Ubuntulibsoup326.103.6.6-1vulnerable
Ubuntulibsoup326.103.6.6-1ubuntu3fixed
Ubuntulibsoup326.043.6.5-4vulnerable
Ubuntulibsoup326.043.6.5-5vulnerable
Ubuntulibsoup326.043.6.5-6vulnerable
Ubuntulibsoup326.043.6.5-7vulnerable
Ubuntulibsoup326.043.6.5-9vulnerable
Ubuntulibsoup326.043.6.6-1vulnerable
Ubuntulibsoup326.043.6.6-1ubuntu0.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibsoup3sourcesid3.8.0-1not yet assignedNot reported[1131447]
Debianlibsoup3sourceforky3.8.0-1not yet assignedNot reported[1131447]
Debianlibsoup3sourcetrixie(unfixed)not yet assignedNot reported[1131447]
Debianlibsoup3sourcebookworm(unfixed)not yet assignedNot reported[1131447]
Debianlibsoup2.4sourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianlibsoup2.4sourcebookworm(unfixed)not yet assignedNot reportedNot reported
Ubuntulibsoup2.4debnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntulibsoup3debnoble3.4.4-5ubuntu0.9Not reportedNot reportedNot reported
Ubuntugir1.2-soup-2.4debnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntugir1.2-soup-3.0debnoble3.4.4-5ubuntu0.9Not reportedNot reportedNot reported
Ubuntulibsoup-2.4-1debnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-0debnoble3.4.4-5ubuntu0.9Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-commondebnoble3.4.4-5ubuntu0.9Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-devdebnoble3.4.4-5ubuntu0.9Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-docdebnoble3.4.4-5ubuntu0.9Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-testsdebnoble3.4.4-5ubuntu0.9Not reportedNot reportedNot reported
Ubuntulibsoup-gnome-2.4-1debnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntulibsoup-gnome2.4-devdebnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntulibsoup2.4-commondebnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntulibsoup2.4-devdebnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntulibsoup2.4-docdebnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntulibsoup2.4-testsdebnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntulibsoup2.4debpro2.74.3-10.1ubuntu5+esm3Not reportedUSN-8890-1Not reported
Ubuntulibsoup2.4deb22.042.74.2-3ubuntu0.9Not reportedUSN-8890-1Not reported
Ubuntulibsoup3debpro3.0.7-0ubuntu1+esm9Not reportedUSN-8890-1Not reported
Ubuntulibsoup2.4deb24.042.74.3-6ubuntu1.9Not reportedUSN-8890-1Not reported
Ubuntulibsoup3deb24.043.4.4-5ubuntu0.9Not reportedUSN-8890-1Not reported
Ubuntulibsoup3deb26.043.6.6-1ubuntu0.1Not reportedUSN-8890-1Not reported
Suselibsouprpmlinux enterprise server 16.03.6.6-160000.2.1Not reportedSUSE-SU-2026:21998-1Not reported
Suselibsouprpmlinux enterprise server for sap applications 16.03.6.6-160000.2.1Not reportedSUSE-SU-2026:21998-1Not reported
Opensuselibsouprpmtumbleweed3.6.6-5.1Not reportedOPENSUSE-SU-2026:10911-1Not reported
Ubuntulibsoup3deb26.103.6.6-1ubuntu3Not reportedUSN-8890-2Not reported
Ubuntulibsoup3deb24.043.4.4-5ubuntu0.9Not reportedUBUNTU-CVE-2026-4271Not reported
Ubuntulibsoup3deb26.103.6.6-1ubuntu3Not reportedUBUNTU-CVE-2026-4271Not reported
Ubuntulibsoup3deb26.043.6.6-1ubuntu0.1Not reportedUBUNTU-CVE-2026-4271Not reported

[Debian bug #1131447]

Notes

[trixie] libsoup3: Minor issue [bookworm] libsoup3: Minor issue [trixie] libsoup2.4: Minor issue [bookworm] libsoup2.4: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [gir1.2-soup-2.4]Affected

    Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • [gir1.2-soup-3.0]Affected

    Source package: [libsoup3]

    Details (2)
    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [libsoup2.4-1]Affected

    Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-1+deb12u1 · all · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · all · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • [libsoup2.4-dev]Affected

    Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • [libsoup2.4-doc]Affected

    Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-1+deb12u1 · all · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · all · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • [libsoup-3.0-0]Affected

    Source package: [libsoup3]

    Details (2)
    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • Source package: [libsoup3]

    Details (2)
    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [libsoup-3.0-dev]Affected

    Source package: [libsoup3]

    Details (2)
    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [libsoup-3.0-doc]Affected

    Source package: [libsoup3]

    Details (2)
    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • Source package: [libsoup3]

    Details (2)
    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

[Debian 13 (Trixie)]

  • [gir1.2-soup-2.4]Affected

    Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-10.1 · amd64 · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · arm64 · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

  • [gir1.2-soup-3.0]Affected

    Source package: [libsoup3]

    Details (2)
    • 3.6.5-3 · amd64 · trixie

      Affected

      nvd · libsoup3 · debian · 13

    • 3.6.5-3 · arm64 · trixie

      Affected

      nvd · libsoup3 · debian · 13

  • [libsoup-2.4-1]Affected

    Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-10.1 · amd64 · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · arm64 · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

  • Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-10.1 · all · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · all · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

  • [libsoup2.4-dev]Affected

    Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-10.1 · amd64 · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · arm64 · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

  • [libsoup2.4-doc]Affected

    Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-10.1 · all · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · all · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

Next results

Observed:

References