CVE-2026-2436
published 2026-03-26CVE-2026-2436: A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees…
PriorityP346high8.2CVSS 3.1
AVNACLPRNUINSUCNILAH
EPSS
0.45%
36.5th percentile
A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libsoup2.4 | — | — |
| debian | libsoup3 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-wpfw-5xvc-wq9w: A flaw was found in libsoup's SoupServer
ghsa_unreviewed·2026-03-26
CVE-2026-2436 [MEDIUM] CWE-825 GHSA-wpfw-5xvc-wq9w: A flaw was found in libsoup's SoupServer
A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service.
OSV
CVE-2026-2436: A flaw was found in libsoup's SoupServer
osv·2026-03-26·CVSS 6.5
CVE-2026-2436 [MEDIUM] CVE-2026-2436: A flaw was found in libsoup's SoupServer
A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service.
Red Hat
libsoup: libsoup: Denial of Service via use-after-free in SoupServer during TLS handshake
vendor_redhat·2026-02-11·CVSS 6.5
CVE-2026-2436 [MEDIUM] CWE-825 libsoup: libsoup: Denial of Service via use-after-free in SoupServer during TLS handshake
libsoup: libsoup: Denial of Service via use-after-free in SoupServer during TLS handshake
A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service.
A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is
Debian
CVE-2026-2436: libsoup2.4 - A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-...
vendor_debian·2026·CVSS 6.5
CVE-2026-2436 [MEDIUM] CVE-2026-2436: libsoup2.4 - A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-...
A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service.
Scope: local
bookworm: open
bullseye: open
trixie: open
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-2436 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.5
CVE-2026-2436 [MEDIUM] CVE-2026-2436 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-2436 :
Linux Debian vulnerability analysis and mitigation
soup_server_disconnect()
Source : NVD
## 6.5
Score
Published March 26, 2026
Severity MEDIUM
CNA Score 6.5
Affected Technologies
Linux Debian
Linux Red Hat
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 32.2
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
libsoup
libsoup3
Sources
NVD
Debian 11, 12, 13, 14 Severity MEDIUM No Fix Added at: Mar 12, 2026
Echo Severity MEDIUM No Fix Added at: Mar 13, 2026
Red Hat 6, 7, 8, 9, 10 Severity MEDIUM No Fix Added at: Mar 11, 2026
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not
Bugzilla
CVE-2026-2436 libsoup: libsoup: Denial of Service via use-after-free in SoupServer during TLS handshake
bugzilla·2026-02-26·CVSS 8.2
CVE-2026-2436 [HIGH] CVE-2026-2436 libsoup: libsoup: Denial of Service via use-after-free in SoupServer during TLS handshake
CVE-2026-2436 libsoup: libsoup: Denial of Service via use-after-free in SoupServer during TLS handshake
SoupServer is vulnerable to use after free vulnerability because soup_server_disconnect() frees all SoupServerConnection objects, even if there is a pending GNUTLS handshake to be finished.
A TLS handshake is initiated asynchronously. After creating the SoupServerConnection, libsoup calls g_tls_connection_handshake_async(), which registers tls_connection_handshake_ready_cb as a callback. The handshake runs in the background andthe callback fires later when it completes.
When the TLS handshake completes successfully, GNUTLS invokes tls_connection_handshake_ready_cb() asynchronously
soup_server_disconnect() is called ( due to some scenario, like a server restart, or other cases). This i
2026-03-26
Published