{ "document":{ "aggregate_severity":{ "namespace":"https://nvd.nist.gov/vuln-metrics/cvss", "text":"High" }, "category":"csaf_vex", "csaf_version":"2.0", "distribution":{ "tlp":{ "label":"WHITE", "url":"https:/www.first.org/tlp/" } }, "lang":"en", "notes":[ { "text":"libsoup3 security update", "category":"general", "title":"Synopsis" }, { "text":"An update for libsoup3 is now available for openEuler-24.03-LTS-SP3", "category":"general", "title":"Summary" }, { "text":"Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.\n\nSecurity Fix(es):\n\nA flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via max_incoming_payload_size, it fails to track or limit memory allocation during decompression. A separate check for decompressed size (max_total_message_size) exists but executes only after inflation is complete, and it is entirely disabled by default for client connections. A remote, unauthenticated attacker can exploit this by sending a small, highly compressed payload (a decompression bomb), causing unbounded memory allocation that triggers an Out-of-Memory (OOM) crash and a Denial of Service (DoS).(CVE-2026-15709)\n\nA heap buffer over-read vulnerability was discovered in libsoup's (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the \"Additional Debug Data\" payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict length-boundary verification before reading this data, a remote, unauthenticated attacker can intentionally send a malformed GOAWAY frame missing the appropriate null delimiter. This causes the library to read past the end of the allocated buffer, triggering an application crash that results in a denial of service (DoS), or potentially exposing fragments of memory contents.(CVE-2026-15712)\n\nA vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated attacker acting as a malicious network peer can trick the connection engine into allocating stream states that are subsequently leaked during cleanup. Over a sustained period, this flaw allows the remote attacker to consume the system's heap allocations incrementally, triggering a denial of service (DoS) through an ultimate Out-of-Memory (OOM) application crash.(CVE-2026-15713)", "category":"general", "title":"Description" }, { "text":"An update for libsoup3 is now available for openEuler-24.03-LTS-SP3.\n\nopenEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.", "category":"general", "title":"Topic" }, { "text":"High", "category":"general", "title":"Severity" }, { "text":"libsoup3", "category":"general", "title":"Affected Component" } ], "publisher":{ "issuing_authority":"openEuler security committee", "name":"openEuler", "namespace":"https://www.openeuler.org", "contact_details":"openeuler-security@openeuler.org", "category":"vendor" }, "references":[ { "summary":"openEuler-SA-2026-4007", "category":"self", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4007" }, { "summary":"CVE-2026-15709", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-15709&packageName=libsoup3" }, { "summary":"CVE-2026-15712", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-15712&packageName=libsoup3" }, { "summary":"CVE-2026-15713", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-15713&packageName=libsoup3" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15709" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15712" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15713" }, { "summary":"openEuler-SA-2026-4007 vex file", "category":"self", "url":"https://repo.openeuler.org/security/data/csaf/advisories/2026/csaf-openeuler-sa-2026-4007.json" } ], "title":"An update for libsoup3 is now available for openEuler-24.03-LTS-SP3", "tracking":{ "initial_release_date":"2026-09-30T16:00:44+08:00", "revision_history":[ { "date":"2026-09-30T16:00:44+08:00", "summary":"Initial", "number":"1.0.0" } ], "generator":{ "date":"2026-09-30T16:00:44+08:00", "engine":{ "name":"openEuler CSAF Tool V1.0" } }, "current_release_date":"2026-09-30T16:00:44+08:00", "id":"openEuler-SA-2026-4007", "version":"1.0.0", "status":"final" } }, "product_tree":{ "branches":[ { "name":"openEuler", "category":"vendor", "branches":[ { "name":"openEuler", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3" }, "product_id":"openEuler-24.03-LTS-SP3", "name":"openEuler-24.03-LTS-SP3" }, "name":"openEuler-24.03-LTS-SP3", "category":"product_version" } ], "category":"product_name" }, { "name":"aarch64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3" }, "product_id":"libsoup3-3.4.5-26.oe2403sp3.aarch64.rpm", "name":"libsoup3-3.4.5-26.oe2403sp3.aarch64.rpm" }, "name":"libsoup3-3.4.5-26.oe2403sp3.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3" }, "product_id":"libsoup3-debuginfo-3.4.5-26.oe2403sp3.aarch64.rpm", "name":"libsoup3-debuginfo-3.4.5-26.oe2403sp3.aarch64.rpm" }, "name":"libsoup3-debuginfo-3.4.5-26.oe2403sp3.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3" }, "product_id":"libsoup3-debugsource-3.4.5-26.oe2403sp3.aarch64.rpm", "name":"libsoup3-debugsource-3.4.5-26.oe2403sp3.aarch64.rpm" }, "name":"libsoup3-debugsource-3.4.5-26.oe2403sp3.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3" }, "product_id":"libsoup3-devel-3.4.5-26.oe2403sp3.aarch64.rpm", "name":"libsoup3-devel-3.4.5-26.oe2403sp3.aarch64.rpm" }, "name":"libsoup3-devel-3.4.5-26.oe2403sp3.aarch64.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"src", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3" }, "product_id":"libsoup3-3.4.5-26.oe2403sp3.src.rpm", "name":"libsoup3-3.4.5-26.oe2403sp3.src.rpm" }, "name":"libsoup3-3.4.5-26.oe2403sp3.src.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"x86_64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3" }, "product_id":"libsoup3-3.4.5-26.oe2403sp3.x86_64.rpm", "name":"libsoup3-3.4.5-26.oe2403sp3.x86_64.rpm" }, "name":"libsoup3-3.4.5-26.oe2403sp3.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3" }, "product_id":"libsoup3-debuginfo-3.4.5-26.oe2403sp3.x86_64.rpm", "name":"libsoup3-debuginfo-3.4.5-26.oe2403sp3.x86_64.rpm" }, "name":"libsoup3-debuginfo-3.4.5-26.oe2403sp3.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3" }, "product_id":"libsoup3-debugsource-3.4.5-26.oe2403sp3.x86_64.rpm", "name":"libsoup3-debugsource-3.4.5-26.oe2403sp3.x86_64.rpm" }, "name":"libsoup3-debugsource-3.4.5-26.oe2403sp3.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3" }, "product_id":"libsoup3-devel-3.4.5-26.oe2403sp3.x86_64.rpm", "name":"libsoup3-devel-3.4.5-26.oe2403sp3.x86_64.rpm" }, "name":"libsoup3-devel-3.4.5-26.oe2403sp3.x86_64.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"noarch", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3" }, "product_id":"libsoup3-help-3.4.5-26.oe2403sp3.noarch.rpm", "name":"libsoup3-help-3.4.5-26.oe2403sp3.noarch.rpm" }, "name":"libsoup3-help-3.4.5-26.oe2403sp3.noarch.rpm", "category":"product_version" } ], "category":"architecture" } ] } ], "relationships":[ { "relates_to_product_reference":"openEuler-24.03-LTS-SP3", "product_reference":"libsoup3-3.4.5-26.oe2403sp3.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.aarch64", "name":"libsoup3-3.4.5-26.oe2403sp3.aarch64 as a component of openEuler-24.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP3", "product_reference":"libsoup3-debuginfo-3.4.5-26.oe2403sp3.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP3:libsoup3-debuginfo-3.4.5-26.oe2403sp3.aarch64", "name":"libsoup3-debuginfo-3.4.5-26.oe2403sp3.aarch64 as a component of openEuler-24.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP3", "product_reference":"libsoup3-debugsource-3.4.5-26.oe2403sp3.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP3:libsoup3-debugsource-3.4.5-26.oe2403sp3.aarch64", "name":"libsoup3-debugsource-3.4.5-26.oe2403sp3.aarch64 as a component of openEuler-24.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP3", "product_reference":"libsoup3-devel-3.4.5-26.oe2403sp3.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP3:libsoup3-devel-3.4.5-26.oe2403sp3.aarch64", "name":"libsoup3-devel-3.4.5-26.oe2403sp3.aarch64 as a component of openEuler-24.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP3", "product_reference":"libsoup3-3.4.5-26.oe2403sp3.src.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.src", "name":"libsoup3-3.4.5-26.oe2403sp3.src as a component of openEuler-24.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP3", "product_reference":"libsoup3-3.4.5-26.oe2403sp3.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.x86_64", "name":"libsoup3-3.4.5-26.oe2403sp3.x86_64 as a component of openEuler-24.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP3", "product_reference":"libsoup3-debuginfo-3.4.5-26.oe2403sp3.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP3:libsoup3-debuginfo-3.4.5-26.oe2403sp3.x86_64", "name":"libsoup3-debuginfo-3.4.5-26.oe2403sp3.x86_64 as a component of openEuler-24.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP3", "product_reference":"libsoup3-debugsource-3.4.5-26.oe2403sp3.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP3:libsoup3-debugsource-3.4.5-26.oe2403sp3.x86_64", "name":"libsoup3-debugsource-3.4.5-26.oe2403sp3.x86_64 as a component of openEuler-24.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP3", "product_reference":"libsoup3-devel-3.4.5-26.oe2403sp3.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP3:libsoup3-devel-3.4.5-26.oe2403sp3.x86_64", "name":"libsoup3-devel-3.4.5-26.oe2403sp3.x86_64 as a component of openEuler-24.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP3", "product_reference":"libsoup3-help-3.4.5-26.oe2403sp3.noarch.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP3:libsoup3-help-3.4.5-26.oe2403sp3.noarch", "name":"libsoup3-help-3.4.5-26.oe2403sp3.noarch as a component of openEuler-24.03-LTS-SP3" }, "category":"default_component_of" } ] }, "vulnerabilities":[ { "cve":"CVE-2026-15709", "notes":[ { "text":"A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via max_incoming_payload_size, it fails to track or limit memory allocation during decompression. A separate check for decompressed size (max_total_message_size) exists but executes only after inflation is complete, and it is entirely disabled by default for client connections. A remote, unauthenticated attacker can exploit this by sending a small, highly compressed payload (a decompression bomb), causing unbounded memory allocation that triggers an Out-of-Memory (OOM) crash and a Denial of Service (DoS).", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-debuginfo-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-debugsource-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-devel-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.src", "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-debuginfo-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-debugsource-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-devel-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-help-3.4.5-26.oe2403sp3.noarch" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-debuginfo-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-debugsource-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-devel-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.src", "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-debuginfo-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-debugsource-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-devel-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-help-3.4.5-26.oe2403sp3.noarch" ], "details":"libsoup3 security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4007" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":7.5, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-debuginfo-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-debugsource-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-devel-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.src", "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-debuginfo-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-debugsource-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-devel-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-help-3.4.5-26.oe2403sp3.noarch" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-15709" }, { "cve":"CVE-2026-15712", "notes":[ { "text":"A heap buffer over-read vulnerability was discovered in libsoup's (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the \"Additional Debug Data\" payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict length-boundary verification before reading this data, a remote, unauthenticated attacker can intentionally send a malformed GOAWAY frame missing the appropriate null delimiter. This causes the library to read past the end of the allocated buffer, triggering an application crash that results in a denial of service (DoS), or potentially exposing fragments of memory contents.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-debuginfo-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-debugsource-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-devel-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.src", "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-debuginfo-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-debugsource-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-devel-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-help-3.4.5-26.oe2403sp3.noarch" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-debuginfo-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-debugsource-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-devel-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.src", "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-debuginfo-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-debugsource-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-devel-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-help-3.4.5-26.oe2403sp3.noarch" ], "details":"libsoup3 security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4007" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":5.9, "vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-debuginfo-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-debugsource-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-devel-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.src", "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-debuginfo-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-debugsource-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-devel-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-help-3.4.5-26.oe2403sp3.noarch" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2026-15712" }, { "cve":"CVE-2026-15713", "notes":[ { "text":"A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated attacker acting as a malicious network peer can trick the connection engine into allocating stream states that are subsequently leaked during cleanup. Over a sustained period, this flaw allows the remote attacker to consume the system's heap allocations incrementally, triggering a denial of service (DoS) through an ultimate Out-of-Memory (OOM) application crash.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-debuginfo-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-debugsource-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-devel-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.src", "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-debuginfo-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-debugsource-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-devel-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-help-3.4.5-26.oe2403sp3.noarch" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-debuginfo-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-debugsource-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-devel-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.src", "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-debuginfo-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-debugsource-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-devel-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-help-3.4.5-26.oe2403sp3.noarch" ], "details":"libsoup3 security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4007" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":5.9, "vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-debuginfo-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-debugsource-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-devel-3.4.5-26.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.src", "openEuler-24.03-LTS-SP3:libsoup3-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-debuginfo-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-debugsource-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-devel-3.4.5-26.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:libsoup3-help-3.4.5-26.oe2403sp3.noarch" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2026-15713" } ] }