CyberRota Analysis
AI-GeneratedA heap use-after-free vulnerability in the HTTP/2 client implementation of libsoup affects GNOME applications during file uploads. Exploitation by a malicious HTTP/2 server or a Man-in-the-Middle attacker can lead to memory corruption, potentially allowing for information disclosure or arbitrary code execution. Organizations using GNOME applications that rely on libsoup should prioritize patching this vulnerability to mitigate the associated risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file body is being read asynchronously. This can lead to memory corruption, potentially resulting in information disclosure or arbitrary code execution.