CVE-2026-2436: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-2436 is a use-after-free vulnerability in libsoup's SoupServer component that allows remote attackers to crash affected servers, resulting in a Denial of Service (DoS). The flaw was reported on February 26, 2026, publicly disclosed on March 26, 2026, and affects GNOME libsoup (all versions tracked under the affected CPE), as well as Red Hat Enterprise Linux 6.0–10.0 and Microsoft Azure Linux 3 (libsoup packages 3.4.4-14 and 3.4.4-15). It carries a CVSS v3.1 base score of 8.2 (High) per NVD, though ENISA/Red Hat score it at 6.5 (Medium) (Red Hat Bugzilla, Microsoft MSRC, GNOME GitLab).

The root cause is an expired pointer dereference (CWE-825) in libsoup's soup_server_disconnect() function. When a server disconnect is triggered (e.g., during a server restart), the function iterates through all active SoupServerConnection objects and frees them — even if a GnuTLS handshake is still pending asynchronously. The TLS handshake is initiated via g_tls_connection_handshake_async(), which registers tls_connection_handshake_ready_cb as a callback; if the handshake completes after the connection object has been freed, the callback fires with a dangling pointer and calls soup_server_connection_connected(conn), which attempts to access the freed object via soup_server_connection_get_iostream(), causing a crash. No authentication or user interaction is required; the attack vector is network-accessible (Red Hat Bugzilla, GNOME GitLab).

Successful exploitation causes the libsoup-based server process to crash, resulting in a Denial of Service and service unavailability for all clients. The vulnerability has no confidentiality impact, but carries a low integrity impact and high availability impact per the CVSS scoring. Affected deployments include applications on Microsoft Azure Linux 3 and Red Hat Enterprise Linux 6.0 through 10.0 that use libsoup's SoupServer with TLS enabled (Red Hat Bugzilla, Microsoft MSRC).

A GitLab issue page for this CVE exists at GNOME's issue tracker and is referenced as a potential PoC source, though no actual exploit code or reproduction steps have been confirmed publicly (GNOME GitLab). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.129%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify network-accessible services running libsoup's SoupServer with TLS enabled on target systems (e.g., RHEL 6–10 or Azure Linux 3 with libsoup 3.4.4-14/3.4.4-15) using port scanning tools such as Nmap.
2. Initiate TLS handshake: Send a TLS ClientHello to the target server to begin an asynchronous TLS handshake, which registers the tls_connection_handshake_ready_cb callback internally.
3. Trigger server disconnect: Simultaneously or immediately after, send a request or condition that causes soup_server_disconnect() to be invoked on the server (e.g., by exploiting a server restart trigger, flooding connections, or leveraging another mechanism that causes the server to disconnect all clients).
4. Race condition exploitation: The timing of the disconnect frees the SoupServerConnection object while the TLS handshake callback is still pending. When the handshake completes, the callback fires with a dangling pointer.
5. Server crash: The callback attempts to access the freed SoupServerConnection via soup_server_connection_get_iostream(), causing a crash and DoS (Red Hat Bugzilla, GNOME GitLab).

• Logs: Repeated server crash logs or segmentation fault entries in system logs (/var/log/messages, journalctl) associated with the libsoup server process; GnuTLS handshake error messages appearing immediately before crashes.
• Process: Unexpected termination of libsoup-based server processes (e.g., core dumps generated by the server process); process restart loops if supervised by systemd or similar.
• Network: High volume of simultaneous TLS connection attempts to the libsoup server port, particularly connections that initiate a handshake but do not complete normally; unusual patterns of rapid connect/disconnect cycles from external IPs.

Microsoft released a patch for Azure Linux 3 (libsoup packages 3.4.4-14 and 3.4.4-15) on April 2, 2026, available via the Microsoft Security Response Center (Microsoft MSRC). GNOME upstream has addressed the issue as documented in their issue tracker (GNOME GitLab). Red Hat Enterprise Linux users should apply available errata for RHEL 6.0–10.0 as released. As a temporary workaround where patching is not immediately possible, restrict network access to affected SoupServer instances and monitor for abnormal server disconnections and TLS handshake failures.

The vulnerability was noted in the Yocto Project security mailing list, indicating awareness in the embedded Linux community (Yocto Security List). Amazon Linux also issued a security advisory (ALAS2023-2026-1778) addressing this CVE. General community reaction has been limited given the moderate exploitability and DoS-only impact, with no significant researcher commentary or media coverage identified beyond standard vulnerability tracking.