{"id":"AZL-92402","summary":"CVE-2026-15713 affecting package libsoup 3.4.4-16","details":"A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated attacker acting as a malicious network peer can trick the connection engine into allocating stream states that are subsequently leaked during cleanup. Over a sustained period, this flaw allows the remote attacker to consume the system's heap allocations incrementally, triggering a denial of service (DoS) through an ultimate Out-of-Memory (OOM) application crash.","modified":"2026-08-31T05:26:27Z","published":"2026-07-14T20:16:57Z","upstream":["CVE-2026-15713"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15713"}],"affected":[{"package":{"name":"libsoup","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/libsoup"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.4.4-16"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-92402.json"}}],"schema_version":"1.9.0"}