8.2

CVE-2026-2436

Exploit

Libsoup: libsoup: denial of service via use-after-free in soupserver during tls handshake

A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gnome ≫ Libsoup Version -
Redhat ≫ Enterprise Linux Version 6.0
Redhat ≫ Enterprise Linux Version 7.0
Redhat ≫ Enterprise Linux Version 8.0
Redhat ≫ Enterprise Linux Version 9.0
Redhat ≫ Enterprise Linux Version 10.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.45% 0.355
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.2 3.9 4.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
RedHat 6.5 2.2 4.2
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
CWE-825 Expired Pointer Dereference

The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.

https://access.redhat.com/security/cve/CVE-2026-2436
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2442909
Third Party Advisory
Issue Tracking
https://gitlab.gnome.org/GNOME/libsoup/-/issues/501
Vendor Advisory
Exploit
Issue Tracking