A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file body is being read asynchronously. This can lead to memory corruption, potentially resulting in information disclosure or arbitrary code execution.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21901-1 advisory.

    - CVE-2026-85197: heap use-after-free in HTTP/2 `client on_data_read()` via `GOAWAY` during body upload     (bsc#1279238).
    - CVE-2026-85534: heap buffer overflow in `SoupSession` through `on_data_source_read_callback()` via     `SETTINGS` frame       with crafted `INITIAL_WINDOW_SIZE` (bsc#1279239).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4273-1 advisory.

    - CVE-2026-85197: heap use-after-free in HTTP/2 `client on_data_read()` via `GOAWAY` during body upload     (bsc#1279238).
    - CVE-2026-85534: heap buffer overflow in `SoupSession` through `on_data_source_read_callback()` via     `SETTINGS` frame       with crafted `INITIAL_WINDOW_SIZE` (bsc#1279239).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4274-1 advisory.

    - CVE-2026-85197: heap use-after-free in HTTP/2 `client on_data_read()` via `GOAWAY` during body upload     (bsc#1279238).
    - CVE-2026-85534: heap buffer overflow in `SoupSession` through `on_data_source_read_callback()` via     `SETTINGS` frame       with crafted `INITIAL_WINDOW_SIZE` (bsc#1279239).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-68235 advisory.

    - Fix CVE-2026-85197: http2 crash after connection destroyed
    - Fix CVE-2026-15711: Reject oversized WebSocket control frames
    - Fix CVE-2026-15709: bound decompressed WebSocket message size
    - Add patches for CVE-2026-4271 and CVE-2026-5119
    - Add patch for CVE-2026-1761
    - Fix CVE-2026-0719
    - Fix CVE-2025-14523
    - Add patch for CVE-2025-12105

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:68235 advisory.

    * SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression     Remote Denial of Service (CVE-2026-15709)
      * libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denial of service via oversized control     frame protocol violation (CVE-2026-15711)
      * libsoup: libsoup: Heap use-after-free in libsoup HTTP/2 client on_data_read() via GOAWAY during body     upload (CVE-2026-85197)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68235 advisory.

    Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access     Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate     packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This     enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion,     very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who     want it), but the SOAP parts were removed long ago.

    Security Fix(es):

    * SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression     Remote Denial of Service (CVE-2026-15709)

    * libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denial of service via oversized control     frame protocol violation (CVE-2026-15711)

    * libsoup: libsoup: Heap use-after-free in libsoup HTTP/2 client on_data_read() via GOAWAY during body     upload (CVE-2026-85197)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit     a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME     application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file body is being     read asynchronously. This can lead to memory corruption, potentially resulting in information disclosure     or arbitrary code execution. (CVE-2026-85197)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
350158	openSUSE 16 Security Update : libsoup (openSUSE-SU-2026:21901-1)	Nessus	SuSE Local Security Checks	Local	high
348730	SUSE SLED15 / SLES15 Security Update : libsoup (SUSE-SU-2026:4273-1)	Nessus	SuSE Local Security Checks	Local	high
348724	SUSE SLES15 Security Update : libsoup (SUSE-SU-2026:4274-1)	Nessus	SuSE Local Security Checks	Local	high
346909	Oracle Linux 10 : libsoup3 (ELSA-2026-68235)	Nessus	Oracle Linux Local Security Checks	Local	high
346869	AlmaLinux 10 : libsoup3 (ALSA-2026:68235)	Nessus	Alma Linux Local Security Checks	Local	high
346431	RHEL 10 : libsoup3 (RHSA-2026:68235)	Nessus	Red Hat Local Security Checks	Local	high
342793	Linux Distros Unpatched Vulnerability : CVE-2026-85197	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-85197

high

Tenable Plugins

high

high

high

high

high

high

high