{"schema":"vulnpedia.research/1","cve":"CVE-2026-85534","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-85534","tags":["vdb-entry","x_refsource_REDHAT","vendor-reference"],"source":"mitre","sourceId":"redhat","modified":"2026-09-04T10:19:22.562Z","origins":[{"source":"mitre","sourceId":"redhat","modified":"2026-09-04T10:19:22.562Z","url":"https://access.redhat.com/security/cve/CVE-2026-85534"},{"source":"nvd","sourceId":"CVE-2026-85534","modified":"2026-09-08T19:08:15.590","url":"https://access.redhat.com/security/cve/CVE-2026-85534"},{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-85534"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528440","tags":["issue-tracking","x_refsource_REDHAT","vendor-reference"],"source":"mitre","sourceId":"redhat","modified":"2026-09-04T10:19:22.562Z","origins":[{"source":"mitre","sourceId":"redhat","modified":"2026-09-04T10:19:22.562Z","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528440"},{"source":"nvd","sourceId":"CVE-2026-85534","modified":"2026-09-08T19:08:15.590","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528440"},{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528440"}]},{"url":"https://gitlab.gnome.org/GNOME/libsoup/-/blob/master/libsoup/http2/soup-client-message-io-http2.c","tags":["vendor-reference"],"source":"mitre","sourceId":"redhat","modified":"2026-09-04T10:19:22.562Z","origins":[{"source":"mitre","sourceId":"redhat","modified":"2026-09-04T10:19:22.562Z","url":"https://gitlab.gnome.org/GNOME/libsoup/-/blob/master/libsoup/http2/soup-client-message-io-http2.c"},{"source":"nvd","sourceId":"CVE-2026-85534","modified":"2026-09-08T19:08:15.590","url":"https://gitlab.gnome.org/GNOME/libsoup/-/blob/master/libsoup/http2/soup-client-message-io-http2.c"},{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://gitlab.gnome.org/GNOME/libsoup/-/blob/master/libsoup/http2/soup-client-message-io-http2.c"}]},{"url":"https://gitlab.gnome.org/GNOME/libsoup/-/work_items/551","tags":["vendor-reference"],"source":"mitre","sourceId":"redhat","modified":"2026-09-04T10:19:22.562Z","origins":[{"source":"mitre","sourceId":"redhat","modified":"2026-09-04T10:19:22.562Z","url":"https://gitlab.gnome.org/GNOME/libsoup/-/work_items/551"},{"source":"nvd","sourceId":"CVE-2026-85534","modified":"2026-09-08T19:08:15.590","url":"https://gitlab.gnome.org/GNOME/libsoup/-/work_items/551"},{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://gitlab.gnome.org/GNOME/libsoup/-/work_items/551"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85534","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-85534"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85534","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85534"}]},{"source":"euvd","sourceId":"EUVD-2026-70997","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-70997","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-70997","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-70997"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json","productId":"red_hat_enterprise_linux_10:libsoup3","product":"libsoup3 as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Do not HTTP/2-upload from non-pollable streams (e.g. GFileInputStream) to untrusted servers. soup_message_set_request_body_from_bytes() is the pollable path. Assertions abort instead of returning an oversized length; that is not a fix."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/libsoup3","origins":[{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json"}]},{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json","productId":"red_hat_enterprise_linux_10:libsoup3-devel","product":"libsoup3-devel as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Do not HTTP/2-upload from non-pollable streams (e.g. GFileInputStream) to untrusted servers. soup_message_set_request_body_from_bytes() is the pollable path. Assertions abort instead of returning an oversized length; that is not a fix."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/libsoup3-devel","origins":[{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json"}]},{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json","productId":"red_hat_enterprise_linux_10:libsoup3-doc","product":"libsoup3-doc as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Do not HTTP/2-upload from non-pollable streams (e.g. GFileInputStream) to untrusted servers. soup_message_set_request_body_from_bytes() is the pollable path. Assertions abort instead of returning an oversized length; that is not a fix."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/libsoup3-doc","origins":[{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json"}]},{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json","productId":"red_hat_enterprise_linux_10:libsoup3.src","product":"libsoup3.src as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Do not HTTP/2-upload from non-pollable streams (e.g. GFileInputStream) to untrusted servers. soup_message_set_request_body_from_bytes() is the pollable path. Assertions abort instead of returning an oversized length; that is not a fix."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/libsoup3?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json"}]},{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json","productId":"red_hat_enterprise_linux_6:libsoup","product":"libsoup as a component of Red Hat Enterprise Linux 6","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/libsoup","origins":[{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json"}]},{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json","productId":"red_hat_enterprise_linux_6:libsoup-devel","product":"libsoup-devel as a component of Red Hat Enterprise Linux 6","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/libsoup-devel","origins":[{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json"}]},{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json","productId":"red_hat_enterprise_linux_6:libsoup.src","product":"libsoup.src as a component of Red Hat Enterprise Linux 6","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/libsoup?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json"}]},{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json","productId":"red_hat_enterprise_linux_7:libsoup","product":"libsoup as a component of Red Hat Enterprise Linux 7","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/libsoup","origins":[{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json"}]},{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json","productId":"red_hat_enterprise_linux_7:libsoup-devel","product":"libsoup-devel as a component of Red Hat Enterprise Linux 7","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/libsoup-devel","origins":[{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json"}]},{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json","productId":"red_hat_enterprise_linux_7:libsoup.src","product":"libsoup.src as a component of Red Hat Enterprise Linux 7","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/libsoup?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json"}]},{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json","productId":"red_hat_enterprise_linux_8:libsoup","product":"libsoup as a component of Red Hat Enterprise Linux 8","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/libsoup","origins":[{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json"}]},{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json","productId":"red_hat_enterprise_linux_8:libsoup-devel","product":"libsoup-devel as a component of Red Hat Enterprise Linux 8","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/libsoup-devel","origins":[{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json"}]},{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json","productId":"red_hat_enterprise_linux_8:libsoup.src","product":"libsoup.src as a component of Red Hat Enterprise Linux 8","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/libsoup?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json"}]},{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json","productId":"red_hat_enterprise_linux_9:libsoup","product":"libsoup as a component of Red Hat Enterprise Linux 9","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/libsoup","origins":[{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json"}]},{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json","productId":"red_hat_enterprise_linux_9:libsoup-devel","product":"libsoup-devel as a component of Red Hat Enterprise Linux 9","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/libsoup-devel","origins":[{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json"}]},{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json","productId":"red_hat_enterprise_linux_9:libsoup.src","product":"libsoup.src as a component of Red Hat Enterprise Linux 9","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/libsoup?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-85534","modified":"2026-09-04T10:41:54+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85534.json"}]}],"vendorCoverage":{"total":16,"shown":16,"omitted":0,"source":"redhat"}}