CVE-2026-2443

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.

Security Fix(es):

A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, :authority, and :path, which may allow a user to cause a denial of service (DoS).(CVE-2025-32908)

A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication. When processing extremely long passwords, an internal size calculation can overflow due to improper use of signed integers. This results in incorrect memory allocation on the stack, followed by unsafe memory copying. As a result, applications using libsoup may crash unexpectedly, creating a denial-of-service risk.(CVE-2026-0719)

A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by sending a specially crafted multipart HTTP response, which can lead to memory corruption. This issue may result in application crashes or arbitrary code execution in applications that process untrusted server responses, and it does not require authentication or user interaction.(CVE-2026-1761)

A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or user interaction by sending specially crafted chunked requests. This allows libsoup to parse and process multiple HTTP requests from a single network message, potentially leading to information disclosure.(CVE-2026-1801)

A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access portions of server memory beyond the intended response. Exploitation requires a vulnerable configuration and access to a server using the embedded SoupServer component.(CVE-2026-2443)

A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by sending specially crafted HTTP/2 requests that cause authentication failures. This can lead to the application attempting to access memory that has already been freed, potentially causing application instability or crashes, resulting in a Denial of Service (DoS).(CVE-2026-4271)

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.

Security Fix(es):

A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, :authority, and :path, which may allow a user to cause a denial of service (DoS).(CVE-2025-32908)

A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication. When processing extremely long passwords, an internal size calculation can overflow due to improper use of signed integers. This results in incorrect memory allocation on the stack, followed by unsafe memory copying. As a result, applications using libsoup may crash unexpectedly, creating a denial-of-service risk.(CVE-2026-0719)

A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by sending a specially crafted multipart HTTP response, which can lead to memory corruption. This issue may result in application crashes or arbitrary code execution in applications that process untrusted server responses, and it does not require authentication or user interaction.(CVE-2026-1761)

A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or user interaction by sending specially crafted chunked requests. This allows libsoup to parse and process multiple HTTP requests from a single network message, potentially leading to information disclosure.(CVE-2026-1801)

A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access portions of server memory beyond the intended response. Exploitation requires a vulnerable configuration and access to a server using the embedded SoupServer component.(CVE-2026-2443)

A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by sending specially crafted HTTP/2 requests that cause authentication failures. This can lead to the application attempting to access memory that has already been freed, potentially causing application instability or crashes, resulting in a Denial of Service (DoS).(CVE-2026-4271)

A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access portions of server memory beyond the intended response. Exploitation requires a vulnerable configuration and access to a server using the embedded SoupServer component.

A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access portions of server memory beyond the intended response. Exploitation requires a vulnerable configuration and access to a server using the embedded SoupServer component.

A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access portions of server memory beyond the intended response. Exploitation requires a vulnerable configuration and access to a server using the embedded SoupServer component.

• CVE-2026-1801: use CRLF as line boundary when parsing chunked encoding data to prevent HTTP request smuggling via lone LF
• CVE-2026-2443: reject Range header ends exceeding content length to prevent out-of-bounds read in byte range handling

• CVE-2026-1801: use CRLF as line boundary when parsing chunked encoding data to prevent HTTP request smuggling via lone LF
• CVE-2026-2443: reject Range header ends exceeding content length to prevent out-of-bounds read in byte range handling

These are all security issues fixed in the libsoup-3_0-0-3.6.5-13.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libsoup-2_4-1-2.74.3-16.1 package on the GA media of openSUSE Tumbleweed.

This update for libsoup2 fixes the following issues:

• CVE-2025-4476: null pointer dereference may lead to denial of service (bsc#1243422).
• CVE-2025-14523: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (bsc#1254876).
• CVE-2025-32049: Denial of Service attack to websocket server (bsc#1240751).
• CVE-2026-0716: improper bounds handling may allow out-of-bounds read (bsc#1256418).
• CVE-2026-0719: stack-based buffer overflow in NTLM authentication can lead to arbitrary code execution (bsc#1256399).
• CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests (bsc#1257398).
• CVE-2026-1539: proxy authentication credentials leaked via the Proxy-Authorization header when handling HTTP redirects (bsc#1257441).
• CVE-2026-1760: improper handling of HTTP requests combining certain headers by SoupServer can lead to HTTP request smuggling and potential DoS (bsc#1257597).
• CVE-2026-2369: Buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

This update for libsoup fixes the following issues:

Update to libsoup 3.6.6:

• CVE-2025-12105: heap use-after-free in message queue handling during HTTP/2 read completion (bsc#1252555).
• CVE-2025-14523: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (bsc#1254876).
• CVE-2025-32049: Denial of Service attack to websocket server (bsc#1240751).
• CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests (bsc#1257398).
• CVE-2026-1539: proxy authentication credentials leaked via the Proxy-Authorization header when handling HTTP redirects (bsc#1257441).
• CVE-2026-1760: improper handling of HTTP requests combining certain headers by SoupServer can lead to HTTP request smuggling and potential DoS (bsc#1257597).
• CVE-2026-2369: Buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

Changelog:

• websocket: Fix out-of-bounds read in process_frame
• Check nulls returned by soup_date_time_new_from_http_string()
• Numerous fixes to handling of Range headers
• server: close the connection after responsing a request containing Content-Length and Transfer-Encoding
• Use CRLF as line boundary when parsing chunked enconding data
• websocket: do not accept messages frames after closing due to an error
• Sanitize filename of content disposition header values
• Always validate the headers value when coming from untrusted source
• uri-utils: do host validation when checking if a GUri is valid
• multipart: check length of bytes read soup_filter_input_stream_read_until()
• message-headers: Reject duplicate Host headers
• server: null-check soup_date_time_to_string()
• auth-digest: fix crash in soup_auth_digest_get_protection_space()
• session: fix 'heap-use-after-free' caused by 'finishing' queue item twice
• cookies: Avoid expires attribute if date is invalid
• http1: Set EOF flag once content-length bytes have been read
• date-utils: Add value checks for date/time parsing
• multipart: Fix multiple boundry limits
• Fixed multiple possible memory leaks
• message-headers: Correct merge of ranges
• body-input-stream: Correct chunked trailers end detection
• server-http2: Correctly validate URIs
• multipart: Fix read out of buffer bounds under soup_multipart_new_from_message()
• headers: Ensure Request-Line comprises entire first line
• tests: Fix MSVC build error
• Fix possible deadlock on init from gmodule usage
• Updated translations.

This update for libsoup2 fixes the following issues:

• CVE-2025-32049: denial of Service attack to websocket server (bsc#1240751).
• CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

This update for libsoup fixes the following issues:

• CVE-2025-32049: denial of Service attack to websocket server (bsc#1240751).
• CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

This update for libsoup fixes the following issues:

• CVE-2025-32049: denial of Service attack to websocket server (bsc#1240751).
• CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

This update for libsoup fixes the following issues:

• CVE-2025-32049: denial of Service attack to websocket server (bsc#1240751).
• CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

This update for libsoup fixes the following issues:

• CVE-2026-0716: improper bounds handling may allow out-of-bounds read (bsc#1256418).
• CVE-2025-4476: null pointer dereference may lead to denial of service (bsc#1243422).
• CVE-2025-32049: denial of Service attack to websocket server (bsc#1240751).
• CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

This update for libsoup2 fixes the following issues:

• CVE-2025-32049: denial of service attack to websocket server (bsc#1240751).
• CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests (bsc#1257398).
• CVE-2026-1539: proxy authentication credentials leaked via the Proxy-Authorization header when handling HTTP redirects (bsc#1257441).
• CVE-2026-1760: improper handling of HTTP requests combining certain headers by SoupServer can lead to HTTP request smuggling and potential DoS (bsc#1257597).
• CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

This update for libsoup fixes the following issues:

• CVE-2025-12105: Fixed heap use-after-free in message queue handling during HTTP/2 read completion. (bsc#1252555)
• CVE-2025-32049: Fixed a Denial of Service attack to websocket server. (bsc#1240751)
• CVE-2026-2443: Fixed an out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers. (bsc#1258170)
• CVE-2026-2369: Fixed a buffer overread due to integer underflow when handling zero-length resources. (bsc#1258120)
• CVE-2026-2708: Fixed HTTP request smuggling via duplicate Content-Length headers. (bsc#1258508)

This update for libsoup fixes the following issues:

• CVE-2025-32049: denial of service attack to websocket server (bsc#1240751).
• CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests (bsc#1257398).
• CVE-2026-1536: HTTP header injection or response splitting via CRLF injection in the Content-Disposition header (bsc#1257440).
• CVE-2026-1539: proxy authentication credentials leaked via the Proxy-Authorization header when handling HTTP redirects (bsc#1257441).
• CVE-2026-1760: improper handling of HTTP requests combining certain headers by SoupServer can lead to HTTP request smuggling and potential DoS (bsc#1257597).
• CVE-2026-1761: incorrect length calculation when parsing of multipart HTTP responses can lead to a stack-based buffer overflow (bsc#1257598).
• CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

This update for libsoup fixes the following issues:

Update to libsoup 3.6.6:

• CVE-2025-12105: heap use-after-free in message queue handling during HTTP/2 read completion (bsc#1252555).
• CVE-2025-14523: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (bsc#1254876).
• CVE-2025-32049: Denial of Service attack to websocket server (bsc#1240751).
• CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests (bsc#1257398).
• CVE-2026-1539: proxy authentication credentials leaked via the Proxy-Authorization header when handling HTTP redirects (bsc#1257441).
• CVE-2026-1760: improper handling of HTTP requests combining certain headers by SoupServer can lead to HTTP request smuggling and potential DoS (bsc#1257597).
• CVE-2026-2369: Buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

Changelog:

• websocket: Fix out-of-bounds read in process_frame
• Check nulls returned by soup_date_time_new_from_http_string()
• Numerous fixes to handling of Range headers
• server: close the connection after responsing a request containing Content-Length and Transfer-Encoding
• Use CRLF as line boundary when parsing chunked enconding data
• websocket: do not accept messages frames after closing due to an error
• Sanitize filename of content disposition header values
• Always validate the headers value when coming from untrusted source
• uri-utils: do host validation when checking if a GUri is valid
• multipart: check length of bytes read soup_filter_input_stream_read_until()
• message-headers: Reject duplicate Host headers
• server: null-check soup_date_time_to_string()
• auth-digest: fix crash in soup_auth_digest_get_protection_space()
• session: fix 'heap-use-after-free' caused by 'finishing' queue item twice
• cookies: Avoid expires attribute if date is invalid
• http1: Set EOF flag once content-length bytes have been read
• date-utils: Add value checks for date/time parsing
• multipart: Fix multiple boundry limits
• Fixed multiple possible memory leaks
• message-headers: Correct merge of ranges
• body-input-stream: Correct chunked trailers end detection
• server-http2: Correctly validate URIs
• multipart: Fix read out of buffer bounds under soup_multipart_new_from_message()
• headers: Ensure Request-Line comprises entire first line
• tests: Fix MSVC build error
• Fix possible deadlock on init from gmodule usage
• Updated translations.

This update for libsoup fixes the following issues:

Update to libsoup 3.6.6:

• CVE-2025-12105: heap use-after-free in message queue handling during HTTP/2 read completion (bsc#1252555).
• CVE-2025-14523: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (bsc#1254876).
• CVE-2025-32049: Denial of Service attack to websocket server (bsc#1240751).
• CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests (bsc#1257398).
• CVE-2026-1539: proxy authentication credentials leaked via the Proxy-Authorization header when handling HTTP redirects (bsc#1257441).
• CVE-2026-1760: improper handling of HTTP requests combining certain headers by SoupServer can lead to HTTP request smuggling and potential DoS (bsc#1257597).
• CVE-2026-2369: Buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

Changelog:

• websocket: Fix out-of-bounds read in process_frame
• Check nulls returned by soup_date_time_new_from_http_string()
• Numerous fixes to handling of Range headers
• server: close the connection after responsing a request containing Content-Length and Transfer-Encoding
• Use CRLF as line boundary when parsing chunked enconding data
• websocket: do not accept messages frames after closing due to an error
• Sanitize filename of content disposition header values
• Always validate the headers value when coming from untrusted source
• uri-utils: do host validation when checking if a GUri is valid
• multipart: check length of bytes read soup_filter_input_stream_read_until()
• message-headers: Reject duplicate Host headers
• server: null-check soup_date_time_to_string()
• auth-digest: fix crash in soup_auth_digest_get_protection_space()
• session: fix 'heap-use-after-free' caused by 'finishing' queue item twice
• cookies: Avoid expires attribute if date is invalid
• http1: Set EOF flag once content-length bytes have been read
• date-utils: Add value checks for date/time parsing
• multipart: Fix multiple boundry limits
• Fixed multiple possible memory leaks
• message-headers: Correct merge of ranges
• body-input-stream: Correct chunked trailers end detection
• server-http2: Correctly validate URIs
• multipart: Fix read out of buffer bounds under soup_multipart_new_from_message()
• headers: Ensure Request-Line comprises entire first line
• tests: Fix MSVC build error
• Fix possible deadlock on init from gmodule usage
• Updated translations.