CVE-2026-85534: libsoup3 Reachable Assertion

Vulnerability summary

CVE-2026-85534 is a medium (CVSS 5.9) Reachable Assertion vulnerability in libsoup3. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 22.9% of scored vulnerabilities.

Timeline

1. 04-09-2026
   PublishedVulnerability first disclosed.
2. 04-09-2026
   Last modifiedVulnerability information updated.

Description

A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGS_INITIAL_WINDOW_SIZE while that buffered read is still in progress. The client then copies the full buffer into a smaller DATA callback without a runtime bounds check, which can abort the process or fail the HTTP/2 session.

• CWE-617Reachable AssertionThe product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.