CVE catalog

CVE-2026-85534

A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A maliciou

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.32% · Oct 25, 2026

A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGS_INITIAL_WINDOW_SIZE while that buffered read is still in progress. The client then copies the full buffer into a smaller DATA callback without a runtime bounds check, which can abort the process or fail the HTTP/2 session.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibsoup3sid3.8.0-3fixed
Debianlibsoup3forky3.8.0-3fixed
Debianlibsoup3trixie3.6.5-3vulnerable
Debianlibsoup3bookworm3.2.3-0+deb12u2vulnerable
Debianlibsoup2.4trixie2.74.3-10.1not affected
Debianlibsoup2.4bookworm2.74.3-1+deb12u1not affected
Ubuntulibsoup2.4noble2.74.3-6ubuntu1.9fixed
Ubuntulibsoup3noble3.4.4-5ubuntu0.9fixed
Ubuntugir1.2-soup-2.4noble2.74.3-6ubuntu1.9fixed
Ubuntugir1.2-soup-3.0noble3.4.4-5ubuntu0.9fixed
Ubuntulibsoup-2.4-1noble2.74.3-6ubuntu1.9fixed
Ubuntulibsoup-3.0-0noble3.4.4-5ubuntu0.9fixed
Ubuntulibsoup-3.0-commonnoble3.4.4-5ubuntu0.9fixed
Ubuntulibsoup-3.0-devnoble3.4.4-5ubuntu0.9fixed
Ubuntulibsoup-3.0-docnoble3.4.4-5ubuntu0.9fixed
Ubuntulibsoup-3.0-testsnoble3.4.4-5ubuntu0.9fixed
Ubuntulibsoup-gnome-2.4-1noble2.74.3-6ubuntu1.9fixed
Ubuntulibsoup-gnome2.4-devnoble2.74.3-6ubuntu1.9fixed
Ubuntulibsoup2.4-commonnoble2.74.3-6ubuntu1.9fixed
Ubuntulibsoup2.4-devnoble2.74.3-6ubuntu1.9fixed
Ubuntulibsoup2.4-docnoble2.74.3-6ubuntu1.9fixed
Ubuntulibsoup2.4-testsnoble2.74.3-6ubuntu1.9fixed
Ubuntulibsoup3pro3.0.4-2vulnerable
Ubuntulibsoup3pro3.0.4-3vulnerable
Ubuntulibsoup3pro3.0.5-1vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm1vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm2vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm3vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm4vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm5vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm6vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm7vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm8vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm9fixed
Ubuntulibsoup324.043.4.2-4vulnerable
Ubuntulibsoup324.043.4.4-1vulnerable
Ubuntulibsoup324.043.4.4-2vulnerable
Ubuntulibsoup324.043.4.4-4vulnerable
Ubuntulibsoup324.043.4.4-5vulnerable
Ubuntulibsoup324.043.4.4-5build1vulnerable
Ubuntulibsoup324.043.4.4-5build2vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.1vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.2vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.3vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.4vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.5vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.6vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.7vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.8vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.9fixed
Ubuntulibsoup326.103.6.6-1vulnerable
Ubuntulibsoup326.103.6.6-1ubuntu3fixed
Ubuntulibsoup326.043.6.5-4vulnerable
Ubuntulibsoup326.043.6.5-5vulnerable
Ubuntulibsoup326.043.6.5-6vulnerable
Ubuntulibsoup326.043.6.5-7vulnerable
Ubuntulibsoup326.043.6.5-9vulnerable
Ubuntulibsoup326.043.6.6-1vulnerable
Ubuntulibsoup326.043.6.6-1ubuntu0.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibsoup3sourcesid3.8.0-1not yet assignedNot reported[1146878]
Debianlibsoup3sourceforky3.8.0-1not yet assignedNot reported[1146878]
Debianlibsoup3sourcetrixie(unfixed)not yet assignedNot reported[1146878]
Debianlibsoup3sourcebookworm(unfixed)not yet assignedNot reported[1146878]
Debianlibsoup2.4sourcetrixieNot affectedunimportantNot reportedNot reported
Debianlibsoup2.4sourcebookwormNot affectedunimportantNot reportedNot reported
Ubuntulibsoup2.4debnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntulibsoup3debnoble3.4.4-5ubuntu0.9Not reportedNot reportedNot reported
Ubuntugir1.2-soup-2.4debnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntugir1.2-soup-3.0debnoble3.4.4-5ubuntu0.9Not reportedNot reportedNot reported
Ubuntulibsoup-2.4-1debnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-0debnoble3.4.4-5ubuntu0.9Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-commondebnoble3.4.4-5ubuntu0.9Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-devdebnoble3.4.4-5ubuntu0.9Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-docdebnoble3.4.4-5ubuntu0.9Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-testsdebnoble3.4.4-5ubuntu0.9Not reportedNot reportedNot reported
Ubuntulibsoup-gnome-2.4-1debnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntulibsoup-gnome2.4-devdebnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntulibsoup2.4-commondebnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntulibsoup2.4-devdebnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntulibsoup2.4-docdebnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntulibsoup2.4-testsdebnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntulibsoup3debpro3.0.7-0ubuntu1+esm9Not reportedUBUNTU-CVE-2026-85534Not reported
Ubuntulibsoup3deb24.043.4.4-5ubuntu0.9Not reportedUBUNTU-CVE-2026-85534Not reported
Ubuntulibsoup3deb26.103.6.6-1ubuntu3Not reportedUBUNTU-CVE-2026-85534Not reported
Ubuntulibsoup3deb26.043.6.6-1ubuntu0.1Not reportedUBUNTU-CVE-2026-85534Not reported

[Debian bug #1146878]

Notes

[trixie] libsoup3: Minor issue [bookworm] libsoup3: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [gir1.2-soup-3.0]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [libsoup-3.0-0]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [libsoup-3.0-common]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [libsoup-3.0-dev]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [libsoup-3.0-doc]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [libsoup-3.0-tests]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [gir1.2-soup-2.4]Not affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Not affected

      nvd · libsoup2.4 · debian · bookworm

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Not affected

      nvd · libsoup2.4 · debian · bookworm

  • [libsoup2.4-1]Not affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Not affected

      nvd · libsoup2.4 · debian · bookworm

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Not affected

      nvd · libsoup2.4 · debian · bookworm

  • [libsoup2.4-common]Not affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · all · bookworm

      Not affected

      nvd · libsoup2.4 · debian · bookworm

    • 2.74.3-1+deb12u1 · all · bookworm

      Not affected

      nvd · libsoup2.4 · debian · bookworm

  • [libsoup2.4-dev]Not affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Not affected

      nvd · libsoup2.4 · debian · bookworm

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Not affected

      nvd · libsoup2.4 · debian · bookworm

  • [libsoup2.4-doc]Not affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · all · bookworm

      Not affected

      nvd · libsoup2.4 · debian · bookworm

    • 2.74.3-1+deb12u1 · all · bookworm

      Not affected

      nvd · libsoup2.4 · debian · bookworm

  • [libsoup2.4-tests]Not affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Not affected

      nvd · libsoup2.4 · debian · bookworm

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Not affected

      nvd · libsoup2.4 · debian · bookworm

  • [libsoup-gnome2.4-1]Not affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Not affected

      nvd · libsoup2.4 · debian · bookworm

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Not affected

      nvd · libsoup2.4 · debian · bookworm

  • [libsoup-gnome2.4-dev]Not affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Not affected

      nvd · libsoup2.4 · debian · bookworm

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Not affected

      nvd · libsoup2.4 · debian · bookworm

[Debian 13 (Trixie)]

  • [gir1.2-soup-3.0]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.6.5-3 · amd64 · trixie

      Affected

      nvd · libsoup3 · debian · 13

    • 3.6.5-3 · arm64 · trixie

      Affected

      nvd · libsoup3 · debian · 13

  • [libsoup-3.0-0]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.6.5-3 · amd64 · trixie

      Affected

      nvd · libsoup3 · debian · 13

    • 3.6.5-3 · arm64 · trixie

      Affected

      nvd · libsoup3 · debian · 13

  • [libsoup-3.0-common]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.6.5-3 · all · trixie

      Affected

      nvd · libsoup3 · debian · 13

    • 3.6.5-3 · all · trixie

      Affected

      nvd · libsoup3 · debian · 13

  • [libsoup-3.0-dev]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.6.5-3 · amd64 · trixie

      Affected

      nvd · libsoup3 · debian · 13

    • 3.6.5-3 · arm64 · trixie

      Affected

      nvd · libsoup3 · debian · 13

  • [libsoup-3.0-doc]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.6.5-3 · all · trixie

      Affected

      nvd · libsoup3 · debian · 13

    • 3.6.5-3 · all · trixie

      Affected

      nvd · libsoup3 · debian · 13

  • [libsoup-3.0-tests]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.6.5-3 · amd64 · trixie

      Affected

      nvd · libsoup3 · debian · 13

    • 3.6.5-3 · arm64 · trixie

      Affected

      nvd · libsoup3 · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]