Red Hat Patches Use After Free Flaw in libsoup3 HTTP2 Client on Enterprise Linux 10
Red Hat has issued security advisory RHSA-2026:82728, an Important-rated update for the libsoup3 package on Red Hat Enterprise Linux 10.0 Extended Update Support. The advisory addresses a single flaw, CVE-2026-85197, described as a heap use-after-free in the libsoup HTTP/2 client inside the on_data_read() function, triggered by a GOAWAY frame arriving during a request body upload. libsoup is the HTTP client library written in C that GNOME and GTK applications rely on to talk to web servers asynchronously, so the affected code is not an optional add-on but a core piece of plumbing underneath desktop and application components on the platform. The advisory covers x86_64, IBM z Systems (s390x), Power little endian (ppc64le) and ARM 64 (aarch64) builds across both the Extended Update Support and the four-years-of-updates channels, as well as the matching CodeReady Linux Builder repositories. Fixed packages are published as libsoup3-3.6.5-3.el10_0.18, with corresponding debuginfo, debugsource, devel and doc builds, and the advisory was issued on 14 October 2026.
Red Hat has not published a full exploitation chain for CVE-2026-85197, so the mechanism below is limited to what the advisory itself states. The flaw sits in the client side of libsoup's HTTP/2 implementation, in the read callback that processes incoming data from a server. If a server sends a GOAWAY frame, the control frame used to signal that a connection is shutting down, while the client is still in the middle of uploading a request body, the library can continue to reference memory associated with that stream after it has already been released. A use-after-free of this type typically results in a crash of the calling application, and in less predictable cases in corruption of heap memory that an attacker may be able to influence. Because the fault is in the client, the exposure is driven by what a libsoup-based application connects to rather than by any listening service on the host, which means the triggering party is the remote HTTP/2 endpoint or anything positioned to impersonate it. Red Hat has assigned the issue Bugzilla 2528425 and rated the overall update as Important; the per-CVE CVSS base score is carried on the CVE page rather than in the errata text.
The practical exposure here is broad but shallow. libsoup3 is pulled in by a wide range of GNOME and GTK components, so most RHEL 10.0 estates will have the package installed somewhere even if administrators do not think of themselves as running an HTTP library, and the EUS and four-year-update channels mean this reaches long-lived, slow-changing systems where packages are deliberately held back. At the same time, the flaw requires a client to initiate an HTTP/2 connection to a hostile or compromised server and to be uploading a body at the moment the GOAWAY arrives, which narrows the realistic opportunity considerably. On current exploitation status, FIRST's EPSS model places CVE-2026-85197 at a 0.3 percent probability of exploitation within the next 30 days, and neither Red Hat nor any authoritative source cited here reports exploitation in the wild, a public proof of concept, or inclusion in CISA's Known Exploited Vulnerabilities catalogue. The meaningful risk for most organisations is therefore accumulated rather than immediate: unpatched libsoup3 on EUS hosts stays vulnerable for the long lifetime of that release, and memory-safety defects in widely linked C libraries have a history of being revisited by researchers once the underlying pattern is public. Systems whose desktop or application workloads routinely fetch content from third-party or user-supplied URLs carry the highest share of that residual exposure.
Attack Surface
Server OS, Endpoint OS
Tactics
Execution, Impact
Techniques
- T1203 – Exploitation for Client Execution
- T1499.004 – Application or System Exploitation
SuperPRO's Threat Countermeasures Procedures
- Update libsoup3 to 3.6.5-3.el10_0.18 or later on all RHEL 10.0 Extended Update Support and four-years-of-updates hosts (x86_64, s390x, ppc64le, aarch64), which is the build Red Hat ships in RHSA-2026:82728 for CVE-2026-85197.
- Inventory affected systems with 'rpm -q libsoup3' or 'dnf list installed libsoup3' and compare against 3.6.5-3.el10_0.18; Red Hat Lightspeed patch analysis can also list systems matching this advisory.
- Update the matching subpackages where they are deployed — libsoup3-devel on EUS systems and libsoup3-doc-3.6.5-3.el10_0.18.noarch from the CodeReady Linux Builder repositories — so build hosts do not link against the vulnerable library.
- Restart or relaunch long-running GNOME, GTK and daemon processes that have the old libsoup3 shared object mapped after the package update; use 'needs-restarting -r' or 'lsof | grep libsoup-3.0.so' to identify processes still holding the pre-patch library.
- Where patching is scheduled rather than immediate, route outbound HTTP/2 traffic from libsoup-based applications through an egress proxy and restrict client connections to approved destinations, since the flaw is triggered by a GOAWAY frame returned by the remote server during a body upload.
- Enable and review abrt or systemd-coredump records for repeated SIGSEGV or SIGABRT crashes in processes linking libsoup-3.0.so, and treat clusters of such crashes on hosts that fetch third-party URLs as worth investigating.
- Track Bugzilla 2528425 and the CVE-2026-85197 page for the published CVSS vector and any later package revisions, as Red Hat notes more recent builds than those listed in the errata may become available.
