CVE-2026-4271: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-4271 is a Use-After-Free (UAF) vulnerability in the HTTP/2 server implementation of libsoup, a GNOME HTTP library written in C. A remote, unauthenticated attacker can exploit this flaw by sending specially crafted HTTP/2 requests that trigger authentication failures, causing the application to access already-freed memory and potentially crash, resulting in a Denial of Service (DoS). The vulnerability was disclosed on March 16, 2026, and affects GNOME libsoup as shipped with Red Hat Enterprise Linux 6.0, 7.0, 8.0, 9.0, and 10.0. It carries a CVSS v3.1 base score of 7.5 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is a Use-After-Free condition (CWE-416) in the on_frame_recv_callback() function within libsoup's HTTP/2 server implementation. During HTTP/2 frame processing, the function increments an internal callback counter and emits signals such as soup_server_message_got_headers(). If a user-defined signal handler disconnects the client connection during this callback — for example, due to an authentication failure — the associated SoupServerMessageIOHTTP2 object may be destroyed and freed while still referenced by the callback. When execution returns to the callback, it continues to access the freed io object and attempts to update internal state, resulting in a heap use-after-free condition exploitable over the network without any authentication or user interaction (Red Hat Bugzilla, GNOME GitLab).

Successful exploitation results in application instability or crashes of the libsoup-based HTTP/2 server, causing a Denial of Service. Because the vulnerability is reachable without authentication and requires no user interaction, any network-accessible service using libsoup's HTTP/2 server implementation is at risk. There is no evidence of confidentiality or integrity impact; the primary consequence is availability loss for affected applications (Red Hat CVE, Red Hat Bugzilla).

No confirmed public exploit code or in-the-wild exploitation has been observed as of the time of this report. The EPSS score is approximately 0.0117 (roughly 1.2%), indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The issue is tracked in the GNOME GitLab issue tracker, but no weaponized exploit or threat actor attribution has been identified (Red Hat CVE, GNOME GitLab).

1. Reconnaissance: Identify services using libsoup's HTTP/2 server implementation on Red Hat Enterprise Linux 6–10 systems, using network scanning tools (e.g., nmap with HTTP/2 detection scripts) to find open HTTPS/HTTP2 endpoints.
2. Establish HTTP/2 connection: Initiate an HTTP/2 connection to the target server, ensuring the server is configured to require authentication (e.g., Basic or Digest auth over HTTP/2).
3. Send crafted HTTP/2 request: Transmit a specially crafted HTTP/2 request with headers designed to trigger an authentication failure in the server's signal handler (e.g., malformed or missing credentials), causing the soup_server_message_got_headers() signal to fire and the handler to disconnect the client.
4. Trigger use-after-free: The disconnection during the on_frame_recv_callback() frees the SoupServerMessageIOHTTP2 object; the callback then continues to access the freed memory, causing a heap use-after-free.
5. Achieve DoS: Repeated or precisely timed requests cause the server process to crash or become unstable, resulting in service unavailability (Red Hat Bugzilla, GNOME GitLab).

• Network: Unusual volume of HTTP/2 connection attempts with authentication failures from a single or rotating source IP; repeated HTTP/2 HEADERS frames followed by immediate RST_STREAM or connection teardown.
• Logs: Application logs showing repeated authentication failure events correlated with process crashes or restarts; crash dumps or core files from the libsoup-based server process.
• Process: Unexpected termination or restart of GNOME/libsoup-based server processes (e.g., segmentation faults or SIGABRT signals in process logs); presence of core dump files in the application working directory.
• System: Increased frequency of service restarts for applications linking against libsoup3 (observable via systemd journal or /var/log/messages).

Red Hat has released patched libsoup3 packages addressing this vulnerability across multiple errata:

• RHSA-2026:15968 (issued 2026-05-11): libsoup3-3.6.5-3.el10_1.11 for Red Hat Enterprise Linux 10 (RHSA-2026:15968)
• RHSA-2026:17482 (issued 2026-05-14): libsoup3-3.6.5-3.el10_0.15 for RHEL 10.0 Extended Update Support (RHSA-2026:17482)
• RHSA-2026:19143 (issued 2026-05-19): libsoup3-3.6.5-3.el10_2.11 for RHEL 10 (RHSA-2026:19143)

Administrators should apply the appropriate update immediately using dnf update libsoup3. If patching cannot be applied immediately, consider implementing network-level filtering to restrict HTTP/2 access to trusted clients, and monitor for application crashes or authentication anomalies.

The vulnerability received coverage from Linux security news outlets and distribution security teams, including SUSE (which issued its own advisories SUSE-SU-202621879-1 and SUSE-SU-20262314-1) and openSUSE, as well as AlmaLinux and Oracle Linux errata. The Yocto Project security mailing list tracked the CVE across multiple updates. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability aggregator coverage.