CVE-2026-2708

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.

Security Fix(es):

A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).(CVE-2025-32049)

A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of service.(CVE-2025-32907)

A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the soup_server_disconnect() function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service.(CVE-2026-2436)

A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.(CVE-2026-2708)

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.

Security Fix(es):

A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.(CVE-2026-2708)

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.

Security Fix(es):

A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.(CVE-2026-2708)

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.

Security Fix(es):

The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.(CVE-2026-12478)

A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.(CVE-2026-2708)

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.

Security Fix(es):

A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.(CVE-2026-2708)

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.

Security Fix(es):

A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.(CVE-2026-2708)

A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.

A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.

• CVE-2026-2708: reject duplicate Content-Length headers with different values to prevent HTTP request smuggling per RFC 9110 section 7.7

• CVE-2026-2708: reject duplicate Content-Length headers with different values to prevent HTTP request smuggling per RFC 9110 section 7.7

These are all security issues fixed in the libsoup-3_0-0-3.6.6-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libsoup-2_4-1-2.74.3-17.1 package on the GA media of openSUSE Tumbleweed.

This update for libsoup2 fixes the following issues:

• CVE-2025-4476: null pointer dereference may lead to denial of service (bsc#1243422).
• CVE-2025-14523: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (bsc#1254876).
• CVE-2025-32049: Denial of Service attack to websocket server (bsc#1240751).
• CVE-2026-0716: improper bounds handling may allow out-of-bounds read (bsc#1256418).
• CVE-2026-0719: stack-based buffer overflow in NTLM authentication can lead to arbitrary code execution (bsc#1256399).
• CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests (bsc#1257398).
• CVE-2026-1539: proxy authentication credentials leaked via the Proxy-Authorization header when handling HTTP redirects (bsc#1257441).
• CVE-2026-1760: improper handling of HTTP requests combining certain headers by SoupServer can lead to HTTP request smuggling and potential DoS (bsc#1257597).
• CVE-2026-2369: Buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

This update for libsoup fixes the following issues:

Update to libsoup 3.6.6:

• CVE-2025-12105: heap use-after-free in message queue handling during HTTP/2 read completion (bsc#1252555).
• CVE-2025-14523: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (bsc#1254876).
• CVE-2025-32049: Denial of Service attack to websocket server (bsc#1240751).
• CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests (bsc#1257398).
• CVE-2026-1539: proxy authentication credentials leaked via the Proxy-Authorization header when handling HTTP redirects (bsc#1257441).
• CVE-2026-1760: improper handling of HTTP requests combining certain headers by SoupServer can lead to HTTP request smuggling and potential DoS (bsc#1257597).
• CVE-2026-2369: Buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

Changelog:

• websocket: Fix out-of-bounds read in process_frame
• Check nulls returned by soup_date_time_new_from_http_string()
• Numerous fixes to handling of Range headers
• server: close the connection after responsing a request containing Content-Length and Transfer-Encoding
• Use CRLF as line boundary when parsing chunked enconding data
• websocket: do not accept messages frames after closing due to an error
• Sanitize filename of content disposition header values
• Always validate the headers value when coming from untrusted source
• uri-utils: do host validation when checking if a GUri is valid
• multipart: check length of bytes read soup_filter_input_stream_read_until()
• message-headers: Reject duplicate Host headers
• server: null-check soup_date_time_to_string()
• auth-digest: fix crash in soup_auth_digest_get_protection_space()
• session: fix 'heap-use-after-free' caused by 'finishing' queue item twice
• cookies: Avoid expires attribute if date is invalid
• http1: Set EOF flag once content-length bytes have been read
• date-utils: Add value checks for date/time parsing
• multipart: Fix multiple boundry limits
• Fixed multiple possible memory leaks
• message-headers: Correct merge of ranges
• body-input-stream: Correct chunked trailers end detection
• server-http2: Correctly validate URIs
• multipart: Fix read out of buffer bounds under soup_multipart_new_from_message()
• headers: Ensure Request-Line comprises entire first line
• tests: Fix MSVC build error
• Fix possible deadlock on init from gmodule usage
• Updated translations.

This update for libsoup2 fixes the following issues:

• CVE-2025-32049: denial of Service attack to websocket server (bsc#1240751).
• CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

This update for libsoup fixes the following issues:

• CVE-2025-32049: denial of Service attack to websocket server (bsc#1240751).
• CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

This update for libsoup fixes the following issues:

• CVE-2025-32049: denial of Service attack to websocket server (bsc#1240751).
• CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

This update for libsoup fixes the following issues:

• CVE-2025-32049: denial of Service attack to websocket server (bsc#1240751).
• CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

This update for libsoup fixes the following issues:

• CVE-2026-0716: improper bounds handling may allow out-of-bounds read (bsc#1256418).
• CVE-2025-4476: null pointer dereference may lead to denial of service (bsc#1243422).
• CVE-2025-32049: denial of Service attack to websocket server (bsc#1240751).
• CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

This update for libsoup2 fixes the following issues:

• CVE-2025-32049: denial of service attack to websocket server (bsc#1240751).
• CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests (bsc#1257398).
• CVE-2026-1539: proxy authentication credentials leaked via the Proxy-Authorization header when handling HTTP redirects (bsc#1257441).
• CVE-2026-1760: improper handling of HTTP requests combining certain headers by SoupServer can lead to HTTP request smuggling and potential DoS (bsc#1257597).
• CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

This update for libsoup fixes the following issues:

• CVE-2025-12105: Fixed heap use-after-free in message queue handling during HTTP/2 read completion. (bsc#1252555)
• CVE-2025-32049: Fixed a Denial of Service attack to websocket server. (bsc#1240751)
• CVE-2026-2443: Fixed an out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers. (bsc#1258170)
• CVE-2026-2369: Fixed a buffer overread due to integer underflow when handling zero-length resources. (bsc#1258120)
• CVE-2026-2708: Fixed HTTP request smuggling via duplicate Content-Length headers. (bsc#1258508)

This update for libsoup fixes the following issues:

• CVE-2025-32049: denial of service attack to websocket server (bsc#1240751).
• CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests (bsc#1257398).
• CVE-2026-1536: HTTP header injection or response splitting via CRLF injection in the Content-Disposition header (bsc#1257440).
• CVE-2026-1539: proxy authentication credentials leaked via the Proxy-Authorization header when handling HTTP redirects (bsc#1257441).
• CVE-2026-1760: improper handling of HTTP requests combining certain headers by SoupServer can lead to HTTP request smuggling and potential DoS (bsc#1257597).
• CVE-2026-1761: incorrect length calculation when parsing of multipart HTTP responses can lead to a stack-based buffer overflow (bsc#1257598).
• CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

This update for libsoup fixes the following issues:

Update to libsoup 3.6.6:

• CVE-2025-12105: heap use-after-free in message queue handling during HTTP/2 read completion (bsc#1252555).
• CVE-2025-14523: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (bsc#1254876).
• CVE-2025-32049: Denial of Service attack to websocket server (bsc#1240751).
• CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests (bsc#1257398).
• CVE-2026-1539: proxy authentication credentials leaked via the Proxy-Authorization header when handling HTTP redirects (bsc#1257441).
• CVE-2026-1760: improper handling of HTTP requests combining certain headers by SoupServer can lead to HTTP request smuggling and potential DoS (bsc#1257597).
• CVE-2026-2369: Buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

Changelog:

• websocket: Fix out-of-bounds read in process_frame
• Check nulls returned by soup_date_time_new_from_http_string()
• Numerous fixes to handling of Range headers
• server: close the connection after responsing a request containing Content-Length and Transfer-Encoding
• Use CRLF as line boundary when parsing chunked enconding data
• websocket: do not accept messages frames after closing due to an error
• Sanitize filename of content disposition header values
• Always validate the headers value when coming from untrusted source
• uri-utils: do host validation when checking if a GUri is valid
• multipart: check length of bytes read soup_filter_input_stream_read_until()
• message-headers: Reject duplicate Host headers
• server: null-check soup_date_time_to_string()
• auth-digest: fix crash in soup_auth_digest_get_protection_space()
• session: fix 'heap-use-after-free' caused by 'finishing' queue item twice
• cookies: Avoid expires attribute if date is invalid
• http1: Set EOF flag once content-length bytes have been read
• date-utils: Add value checks for date/time parsing
• multipart: Fix multiple boundry limits
• Fixed multiple possible memory leaks
• message-headers: Correct merge of ranges
• body-input-stream: Correct chunked trailers end detection
• server-http2: Correctly validate URIs
• multipart: Fix read out of buffer bounds under soup_multipart_new_from_message()
• headers: Ensure Request-Line comprises entire first line
• tests: Fix MSVC build error
• Fix possible deadlock on init from gmodule usage
• Updated translations.

This update for libsoup fixes the following issues:

Update to libsoup 3.6.6:

• CVE-2025-12105: heap use-after-free in message queue handling during HTTP/2 read completion (bsc#1252555).
• CVE-2025-14523: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (bsc#1254876).
• CVE-2025-32049: Denial of Service attack to websocket server (bsc#1240751).
• CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests (bsc#1257398).
• CVE-2026-1539: proxy authentication credentials leaked via the Proxy-Authorization header when handling HTTP redirects (bsc#1257441).
• CVE-2026-1760: improper handling of HTTP requests combining certain headers by SoupServer can lead to HTTP request smuggling and potential DoS (bsc#1257597).
• CVE-2026-2369: Buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

Changelog:

• websocket: Fix out-of-bounds read in process_frame
• Check nulls returned by soup_date_time_new_from_http_string()
• Numerous fixes to handling of Range headers
• server: close the connection after responsing a request containing Content-Length and Transfer-Encoding
• Use CRLF as line boundary when parsing chunked enconding data
• websocket: do not accept messages frames after closing due to an error
• Sanitize filename of content disposition header values
• Always validate the headers value when coming from untrusted source
• uri-utils: do host validation when checking if a GUri is valid
• multipart: check length of bytes read soup_filter_input_stream_read_until()
• message-headers: Reject duplicate Host headers
• server: null-check soup_date_time_to_string()
• auth-digest: fix crash in soup_auth_digest_get_protection_space()
• session: fix 'heap-use-after-free' caused by 'finishing' queue item twice
• cookies: Avoid expires attribute if date is invalid
• http1: Set EOF flag once content-length bytes have been read
• date-utils: Add value checks for date/time parsing
• multipart: Fix multiple boundry limits
• Fixed multiple possible memory leaks
• message-headers: Correct merge of ranges
• body-input-stream: Correct chunked trailers end detection
• server-http2: Correctly validate URIs
• multipart: Fix read out of buffer bounds under soup_multipart_new_from_message()
• headers: Ensure Request-Line comprises entire first line
• tests: Fix MSVC build error
• Fix possible deadlock on init from gmodule usage
• Updated translations.

This update for libsoup fixes the following issues:

• CVE-2026-12547: Header "Proxy-Authorization" leads to credentials being send to different proxy after proxy switch (bsc#1272195).
• CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation (bsc#1272196).
• CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol violation (bsc#1271446).
• CVE-2026-15712: SoupClientMessageIOHTTP2: HTTP/2 GOAWAY frame parsing heap buffer over-read via invalid NUL- termination assumption (bsc#1271447).
• CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak (bsc#1271448).
• CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers via an oversized multipart boundary string (bsc#1271449).
• CVE-2026-66339: proxy credentials leak to destination server via Proxy-Authorization header in CONNECT tunnels (bsc#1273156).
• CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding (bsc#1283299).
• CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).
• CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).
• CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).
• CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).
• CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).
• CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling (bsc#1283831).

This update for libsoup fixes the following issues:

• CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak (bsc#1271448).
• CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding (bsc#1283299).
• CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).
• CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).
• CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).
• CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).
• CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).

This update for libsoup fixes the following issues:

• CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak (bsc#1271448).
• CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding (bsc#1283299).
• CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).
• CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).
• CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).
• CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).
• CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).

This update for libsoup2 fixes the following issues:

• CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch (bsc#1272195).
• CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol violation (bsc#1271446).
• CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak (bsc#1271448).
• CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers via an oversized multipart boundary string (bsc#1271449).
• CVE-2026-66339: proxy credentials leak to destination server via Proxy-Authorization header in CONNECT tunnels (bsc#1273156).
• CVE-2026-77014: Integer truncation in sort_ranges() comparator causes silent omission of HTTP Range responses (bsc#1275988).
• CVE-2026-77680: quadratic CPU denial of service in HTTP Range coalescing after the CVE-2025-32907 fix (bsc#1276759).
• CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).
• CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).
• CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).
• CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).
• CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).
• CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling (bsc#1283831).

This update for libsoup2 fixes the following issues:

• CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch (bsc#1272195).
• CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol violation (bsc#1271446).
• CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak (bsc#1271448).
• CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers via an oversized multipart boundary string (bsc#1271449).
• CVE-2026-66339: proxy credentials leak to destination server via Proxy-Authorization header in CONNECT tunnels (bsc#1273156).
• CVE-2026-77014: Integer truncation in sort_ranges() comparator causes silent omission of HTTP Range responses (bsc#1275988).
• CVE-2026-77680: quadratic CPU denial of service in HTTP Range coalescing after the CVE-2025-32907 fix (bsc#1276759).
• CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).
• CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).
• CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).
• CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).
• CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).
• CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling (bsc#1283831).