CVE-2026-15712

{
  "id": "CVE-2026-15712",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-14T19:16:51.313",
  "lastModified": "2026-10-24T21:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A heap buffer over-read vulnerability was discovered in libsoup's (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the \"Additional Debug Data\" payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict length-boundary verification before reading this data, a remote, unauthenticated attacker can intentionally send a malformed GOAWAY frame missing the appropriate null delimiter. This causes the library to read past the end of the allocated buffer, triggering an application crash that results in a denial of service (DoS), or potentially exposing fragments of memory contents."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de lectura excesiva de búfer de pila fue descubierta en el framework de seguimiento de conexiones HTTP/2 de libsoup (versiones: libsoup 3.0 a 3.7.0). Cuando la biblioteca procesa un marco GOAWAY de HTTP/2, maneja incorrectamente la carga útil ’Additional Debug Data’ al asumir que el flujo de datos es una cadena C terminada en NUL de forma segura. Debido a que el analizador carece de una verificación estricta de los límites de longitud antes de leer estos datos, un atacante remoto no autenticado puede enviar intencionalmente un marco GOAWAY malformado al que le falta el delimitador nulo apropiado. Esto hace que la biblioteca lea más allá del final del búfer asignado, lo que provoca un fallo de la aplicación que resulta en una denegación de servicio (DoS), o potencialmente exponiendo fragmentos del contenido de la memoria."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "libsoup3",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-14T19:15:34.225845Z",
          "id": "CVE-2026-15712",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-15712",
      "source": "[email protected]"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499939",
      "source": "[email protected]"
    },
    {
      "url": "https://gitlab.gnome.org/GNOME/libsoup/-/work_items/540",
      "source": "[email protected]"
    },
    {
      "url": "https://gitlab.gnome.org/GNOME/libsoup/-/work_items/540",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}