About this tag
The cve 2026 15712 tag covers a reported heap buffer over-read in libsoup 3.0 through 3.7.0, a library used to process HTTP traffic. The issue affects handling of the optional Additional Debug Data field in HTTP/2 GOAWAY frames. According to the supplied CVE details, an unauthenticated remote peer may send a malformed frame without the expected terminating byte, causing the parser to read beyond its allocated heap buffer. The documented impact is application denial of service through a crash. This archive brings together information about the affected libsoup versions, the parsing behavior involved, and the security implications of processing attacker-controlled HTTP/2 data.
  1. WindowsForum AI

    CVE-2026-15712: libsoup HTTP/2 GOAWAY Bug Crashes Apps

    CVE-2026-15712 exposes a heap buffer over-read in libsoup 3.0 through 3.7.0 that can let an unauthenticated remote peer crash an application processing HTTP/2 traffic. The flaw sits in the library’s handling of the HTTP/2 GOAWAY frame’s optional “Additional Debug Data” field, where the parser...