https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 18:20:47 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-85534 <p>A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGS_INITIAL_WINDOW_SIZE while that buffered read is still in progress. The client then copies the full buffer into a smaller DATA callback without a runtime bounds check, which can abort the process or fail the HTTP/2 session.</p> <p>A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGS_INITIAL_WINDOW_SIZE while that buffered read is still in progress. The client then copies the full buffer into a smaller DATA callback without a runtime bounds check, which can abort the process or fail the HTTP/2 session.</p> https://db.gcve.eu/vuln/fkie_cve-2026-85534 https://db.gcve.eu/vuln/ghsa-qm5f-xr9c-mm27 <p>A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGS_INITIAL_WINDOW_SIZE while that buffered read is still in progress. The client then copies the full buffer into a smaller DATA callback without a runtime bounds check, which can abort the process or fail the HTTP/2 session.</p> <p>A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGS_INITIAL_WINDOW_SIZE while that buffered read is still in progress. The client then copies the full buffer into a smaller DATA callback without a runtime bounds check, which can abort the process or fail the HTTP/2 session.</p> https://db.gcve.eu/vuln/ghsa-qm5f-xr9c-mm27 https://db.gcve.eu/vuln/msrc_cve-2026-85534 msrc_CVE-2026-85534 https://db.gcve.eu/vuln/msrc_cve-2026-85534 https://db.gcve.eu/vuln/opensuse-su-2026:11823-1 <p>libsoup-3_0-0-3.6.6-9.1 on GA media</p> <p>libsoup-3_0-0-3.6.6-9.1 on GA media</p> https://db.gcve.eu/vuln/opensuse-su-2026:11823-1 https://db.gcve.eu/vuln/suse-su-2026:23848-1 <p>Security update for libsoup</p> <p>Security update for libsoup</p> https://db.gcve.eu/vuln/suse-su-2026:23848-1 https://db.gcve.eu/vuln/ubuntu-cve-2026-85534 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: libsoup2.4, Ubuntu:Pro:18.04:LTS: libsoup2.4, Ubuntu:Pro:20.04:LTS: libsoup2.4, Ubuntu:22.04:LTS: libsoup2.4, Ubuntu:Pro:22.04:LTS: libsoup3, Ubuntu:24.04:LTS: libsoup2.4, Ubuntu:24.04:LTS: libsoup3, Ubuntu:26.04:LTS: libsoup3, Ubuntu:Pro:26.04:LTS: libsoup2.4</p> <p>A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGS_INITIAL_WINDOW_SIZE while that buffered read is still in progress. The client then copies the full buffer into a smaller DATA callback without a runtime bounds check, which can abort the process or fail the HTTP/2 session.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: libsoup2.4, Ubuntu:Pro:18.04:LTS: libsoup2.4, Ubuntu:Pro:20.04:LTS: libsoup2.4, Ubuntu:22.04:LTS: libsoup2.4, Ubuntu:Pro:22.04:LTS: libsoup3, Ubuntu:24.04:LTS: libsoup2.4, Ubuntu:24.04:LTS: libsoup3, Ubuntu:26.04:LTS: libsoup3, Ubuntu:Pro:26.04:LTS: libsoup2.4</p> <p>A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGS_INITIAL_WINDOW_SIZE while that buffered read is still in progress. The client then copies the full buffer into a smaller DATA callback without a runtime bounds check, which can abort the process or fail the HTTP/2 session.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-85534