CVSS 3.1
8.2 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:HCVE-2026-2436
High (8.2). EPSS 0.5% chance of exploitation in the next 30 days.
A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-11-01)
- CWE
- CWE-825
- Published
- Modified
- Record from
- the NVD, synced
Affected
- gnome:libsoup
- redhat:enterprise_linux