CVE-2026-85197

Name of the Vulnerable Software and Affected Versions libsoup versions prior to 3.6.6-9.1

Description A heap use-after-free flaw exists in the HTTP/2 client implementation. This issue occurs when a GNOME application uploads a file using HTTP/2 and the server sends a GOAWAY frame while the file body is being read asynchronously. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit this to cause memory corruption, which may lead to arbitrary code execution or information disclosure.

Recommendations Update to version 3.6.6-9.1.