libsoup SoupServer Use-After-Free Vulnerability Leading to Denial-of-Service

A use-after-free vulnerability has been identified in libsoup's SoupServer component. This flaw allows remote attackers to cause a denial-of-service by exploiting the premature freeing of connection objects during a TLS handshake. When the handshake is completed after the connection object has been released, it creates a dangling pointer that, when accessed, leads to a server crash.

Impact

Exploitation of this vulnerability causes the server to crash, creating a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by initiating a TLS handshake with a SoupServer connection. While the handshake is still pending, the 'soup_server_disconnect()' function is called, which prematurely frees the connection object. If the handshake then completes, the callback attempts to access the now-freed object, resulting in a crash.