GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup header parse param list strict. There is a plausible way to reach this remotely via soup message headers get content type (e.g., an application may want to retrieve the content type of a request or response).