cve 2026 15712

CVE-2026-15712 exposes a heap buffer over-read in libsoup 3.0 through 3.7.0 that can let an unauthenticated remote peer crash an application processing HTTP/2 traffic. The flaw sits in the library’s handling of the HTTP/2 GOAWAY frame’s optional “Additional Debug Data” field, where the parser...