A critical use-after-free vulnerability in the GNOME libsoup library allows remote, unauthenticated attackers to cause a denial-of-service condition in affected applications.

This flaw involves a use-after-free memory access triggered during asynchronous message queue handling. An unauthenticated remote attacker can exploit this by initiating specific HTTP/2 read and cancel sequences, causing the library to free an internal message queue item twice.

The vulnerability carries a CVSS score of 7.5, indicating a high severity risk primarily due to the potential for service disruption. Successful exploitation results in an application crash, which can lead to significant downtime for critical business services relying on GNOME or WebKit-based applications for HTTP/2 communications.

Immediate Action: Update the libsoup library to version 3.6.5-3.el10_1.7 or later for Red Hat Enterprise Linux 10, or apply the latest security errata provided by your distribution vendor.

Proactive Monitoring: Review system and application logs for unusual crashes or repeated process failures involving web-based components.

Compensating Controls: Deploy network-level traffic inspection to identify and block malformed or highly frequent HTTP/2 request and cancellation patterns that may indicate exploitation attempts.

Public Exploit Available: No

Given the ease of exploitability and the widespread use of the libsoup library in desktop and server environments, administrators should prioritize patching. Apply the vendor-supplied updates immediately to ensure memory safety and prevent potential service instability caused by this use-after-free condition.