libsoup HTTP/2 Memory Leak Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in libsoup's HTTP/2 protocol implementation. The issue arises because the library does not properly release memory context blocks under certain stream termination conditions, such as window exhaustion or explicit stream resets. This flaw allows a remote, unauthenticated attacker to manipulate the connection engine into leaking allocated stream states during cleanup. Over time, this memory leakage can exhaust the application's heap allocations, causing an Out-of-Memory crash. The vulnerability affects libsoup versions prior to the fixed version in Red Hat Enterprise Linux 10.

Impact

Exploitation of this vulnerability leads to a gradual memory leak in the application process, causing it to crash when it runs out of available memory. This issue poses a significant reliability risk for cloud daemons or desktop clients that use libsoup for HTTP/2 communications over untrusted networks.

Reproduction

The vulnerability can be reproduced by sending multiple concurrent HTTP/2 requests to a libsoup client that is using a shared cache. The server must include an 'Authorization' header in the response, which will be cached. When a different session requests the same URL without the proper cache control headers, it will receive the cached response containing the 'Authorization' header from the first request, thereby leaking sensitive information.

Remediation

Users are advised to avoid connecting to untrusted HTTP/2 servers. Implementing network egress filtering to restrict outbound connections to only trusted destinations can help reduce exposure to this vulnerability.