CVE-2026-85197High· 7.6▾ MidnightPoC availableA flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.8 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
Exploit / PoC code exists
0.2% → 0.2%
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file body is being read asynchronously. This can lead to memory corruption, potentially resulting in information disclosure or arbitrary code execution.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-15709High· 7.5A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension
CVE-2026-15711High· 7.5A vulnerability was found in libsoup's WebSocket frame parsing implementation
CVE-2026-0716Medium· 4.8A flaw was found in libsoup’s WebSocket frame processing when handling incoming messages
CVE-2026-12478Medium· 4.8The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected
CVE-2026-91203Medium· 6.0A flaw was found in cockpit-files
CVE-2026-92747Medium· 5.0A flaw was found in `cockpit-machines`