Every CVE Search/ Get API key

CVE-2026-6324

Libsoup: libsoup: http request smuggling via unsigned to signed conversion error

4.8 MediumFix available

A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soup_body_input_stream_read_chunked() function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.87%Up 0.8 points since May 29, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.8

Libsoup: libsoup: http request smuggling via unsigned to signed conversion error

A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soup_body_input_stream_read_chunked() function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.

Record
CVE-2026-6324
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-444
Updated
2026-11-05
EUVDEUVD-2026-33249 4.8

A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soup_body_input_stream_read_chunked() function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.

Record
EUVD-2026-33249
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-05
GitHub AdvisoriesGHSA-2637-3gxc-qg4f 4.8

A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion...

A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soup_body_input_stream_read_chunked() function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.

Record
GHSA-2637-3gxc-qg4f
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-444
Updated
2026-11-03
NVD 4.8

A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soup_body_input_stream_read_chunked() function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.

Record
CVE-2026-6324
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-444
Updated
2026-11-05
OSV 4.8

Libsoup: libsoup: http request smuggling via unsigned to signed conversion error

A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soup_body_input_stream_read_chunked() function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.

Record
CVE-2026-6324
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-444
Updated
2026-11-06
OSVDEBIAN-CVE-2026-6324 4.8

A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soup_body_input_stream_read_chunked() function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.

Record
DEBIAN-CVE-2026-6324
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-03
Show 8 moreShow less
OSVOESA-2026-2615 4.8

libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.

Security Fix(es):

A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soup_body_input_stream_read_chunked() function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.(CVE-2026-6324)

Record
OESA-2026-2615
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVOESA-2026-2616 4.8

libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.

Security Fix(es):

A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soup_body_input_stream_read_chunked() function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.(CVE-2026-6324)

Record
OESA-2026-2616
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVOESA-2026-2617 7.5

libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.

Security Fix(es):

A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).(CVE-2025-32049)

A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soup_body_input_stream_read_chunked() function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.(CVE-2026-6324)

Record
OESA-2026-2617
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2618 7.5

libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.

Security Fix(es):

A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).(CVE-2025-32049)

A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soup_body_input_stream_read_chunked() function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.(CVE-2026-6324)

Record
OESA-2026-2618
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-6324 4.8

A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soup_body_input_stream_read_chunked() function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.

Record
UBUNTU-CVE-2026-6324
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-03
OSVAZL-89304 No score

CVE-2026-6324 affecting package libsoup for versions less than 3.4.4-16

A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soup_body_input_stream_read_chunked() function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.

Record
AZL-89304
Updated
2026-11-05
OSVUSN-8890-1 No score

libsoup2.4, libsoup3 vulnerabilities

It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-4271)

It was discovered that libsoup incorrectly handled certain HTTPS proxy connections. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-5119)

It was discovered that libsoup incorrectly parsed certain chunked HTTP requests. A remote attacker could possibly use this issue to bypass security controls. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-6324)

It was discovered that libsoup incorrectly handled proxy authentication credentials. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-66339)

It was discovered that libsoup incorrectly handled certain HTTP Range headers. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-77014, CVE-2026-77680)

It was discovered that libsoup incorrectly handled certain HTTP/2 connections. A remote attacker could possibly use this issue to obtain sensitive information or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-85197)

It was discovered that libsoup incorrectly handled certain HTTP/2 transfers. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-85534)

Record
USN-8890-1
Updated
2026-11-02
OSVUSN-8890-2 No score

libsoup3 vulnerabilities

USN-8890-1 fixed vulnerabilities in libsoup. This update provides the corresponding updates for libsoup3 on Ubuntu 26.10.

Original advisory details:

It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-4271)

It was discovered that libsoup incorrectly handled certain HTTPS proxy connections. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-5119)

It was discovered that libsoup incorrectly parsed certain chunked HTTP requests. A remote attacker could possibly use this issue to bypass security controls. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-6324)

It was discovered that libsoup incorrectly handled proxy authentication credentials. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-66339)

It was discovered that libsoup incorrectly handled certain HTTP Range headers. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-77014, CVE-2026-77680)

It was discovered that libsoup incorrectly handled certain HTTP/2 connections. A remote attacker could possibly use this issue to obtain sensitive information or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-85197)

It was discovered that libsoup incorrectly handled certain HTTP/2 transfers. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-85534)

Record
USN-8890-2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libsoup
Azure Linux:3
 before 3.4.4-16
3.4.4-16
libsoup2.4
Debian:12
 All versions, plus listed versions
2.74.3-12.74.3-1+deb12u12.74.3-102.74.3-10.12.74.3-11
Show 11 moreShow less
2.74.3-22.74.3-32.74.3-3.1~exp12.74.3-3.1~exp22.74.3-3.1~exp32.74.3-52.74.3-62.74.3-72.74.3-82.74.3-8.12.74.3-9
 None known
libsoup2.4
Debian:13
 All versions, plus listed versions
2.74.3-10.12.74.3-11
 None known
libsoup3
Debian:12
 All versions, plus listed versions
3.2.2-23.2.3-0+deb12u13.2.3-0+deb12u23.3.1-13.4.0-1
Show 33 moreShow less
3.4.1-13.4.2-13.4.2-23.4.2-33.4.2-43.4.3-13.4.4-13.4.4-23.4.4-33.4.4-43.4.4-53.5.2-13.6.0-13.6.0-23.6.0-33.6.0-43.6.1-13.6.4-13.6.4-23.6.4-33.6.5-13.6.5-23.6.5-33.6.5-43.6.5-53.6.5-63.6.5-73.6.5-83.6.5-93.6.6-13.8.0-13.8.0-23.8.0-3
 None known
libsoup3
Debian:13
 All versions, plus listed versions
3.6.5-33.6.5-43.6.5-53.6.5-63.6.5-7
Show 6 moreShow less
3.6.5-83.6.5-93.6.6-13.8.0-13.8.0-23.8.0-3
 None known
libsoup
openEuler:20.03-LTS-SP4
 before 2.71.0-17.oe2003sp4
2.71.0-17.oe2003sp4
libsoup
openEuler:22.03-LTS-SP4
 before 2.74.2-18.oe2203sp4
2.74.2-18.oe2203sp4
libsoup
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 2.74.3-19.oe2403sp1
2.74.3-19.oe2403sp1
libsoup
openEuler:24.03-LTS-SP3
From an advisory covering 2 CVEs
 before 2.74.3-19.oe2403sp3
2.74.3-19.oe2403sp3
libsoup2.4
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.50.0-2debian12.52.1-12.52.2-12.52.2-1ubuntu0.12.52.2-1ubuntu0.2
Show 10 moreShow less
2.52.2-1ubuntu0.32.52.2-1ubuntu0.3+esm12.52.2-1ubuntu0.3+esm22.52.2-1ubuntu0.3+esm32.52.2-1ubuntu0.3+esm42.52.2-1ubuntu0.3+esm52.52.2-1ubuntu0.3+esm62.52.2-1ubuntu0.3+esm72.52.2-1ubuntu0.3+esm82.52.2-1ubuntu0.3+esm9
 None known
Show 22 moreShow less
Affected packages
PackageAffectedFixed
libsoup2.4
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.60.1-12.60.2-12.60.2-22.60.3-12.61.90-1
Show 15 moreShow less
2.62.0-12.62.1-12.62.1-1ubuntu0.12.62.1-1ubuntu0.32.62.1-1ubuntu0.42.62.1-1ubuntu0.4+esm12.62.1-1ubuntu0.4+esm22.62.1-1ubuntu0.4+esm32.62.1-1ubuntu0.4+esm42.62.1-1ubuntu0.4+esm52.62.1-1ubuntu0.4+esm62.62.1-1ubuntu0.4+esm72.62.1-1ubuntu0.4+esm82.62.1-1ubuntu0.4+esm92.62.1-1ubuntu0.4+esm10
 None known
libsoup2.4
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.68.2-0ubuntu12.68.2-12.68.2-22.68.2-2build22.69.90-1
Show 11 moreShow less
2.70.0-12.70.0-1ubuntu0.12.70.0-1ubuntu0.22.70.0-1ubuntu0.32.70.0-1ubuntu0.42.70.0-1ubuntu0.52.70.0-1ubuntu0.5+esm12.70.0-1ubuntu0.5+esm22.70.0-1ubuntu0.5+esm32.70.0-1ubuntu0.5+esm42.70.0-1ubuntu0.5+esm5
 None known
libsoup2.4
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.72.0-3ubuntu32.74.1-12.74.2-22.74.2-32.74.2-3ubuntu0.1
Show 9 moreShow less
2.74.2-3ubuntu0.22.74.2-3ubuntu0.32.74.2-3ubuntu0.42.74.2-3ubuntu0.52.74.2-3ubuntu0.62.74.2-3ubuntu0.72.74.2-3ubuntu0.82.74.2-3ubuntu0.92.74.2-3ubuntu0.10
 None known
libsoup3
Ubuntu:Pro:22.04:LTS
 before 3.0.7-0ubuntu1+esm9, plus listed versions
3.0.4-23.0.4-33.0.5-13.0.7-0ubuntu13.0.7-0ubuntu1+esm1
Show 7 moreShow less
3.0.7-0ubuntu1+esm23.0.7-0ubuntu1+esm33.0.7-0ubuntu1+esm43.0.7-0ubuntu1+esm53.0.7-0ubuntu1+esm63.0.7-0ubuntu1+esm73.0.7-0ubuntu1+esm8
3.0.7-0ubuntu1+esm9
libsoup2.4
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.74.3-12.74.3-22.74.3-32.74.3-62.74.3-6build1
Show 11 moreShow less
2.74.3-6ubuntu12.74.3-6ubuntu1.12.74.3-6ubuntu1.22.74.3-6ubuntu1.32.74.3-6ubuntu1.42.74.3-6ubuntu1.52.74.3-6ubuntu1.62.74.3-6ubuntu1.72.74.3-6ubuntu1.82.74.3-6ubuntu1.92.74.3-6ubuntu1.10
 None known
libsoup3
Ubuntu:24.04:LTS
 before 3.4.4-5ubuntu0.9, plus listed versions
3.4.2-43.4.4-13.4.4-23.4.4-43.4.4-5
Show 10 moreShow less
3.4.4-5build13.4.4-5build23.4.4-5ubuntu0.13.4.4-5ubuntu0.23.4.4-5ubuntu0.33.4.4-5ubuntu0.43.4.4-5ubuntu0.53.4.4-5ubuntu0.63.4.4-5ubuntu0.73.4.4-5ubuntu0.8
3.4.4-5ubuntu0.9
libsoup2.4
Ubuntu:25.10
 All versions, plus listed versions
2.74.3-102.74.3-10.12.74.3-10.1ubuntu12.74.3-10.1ubuntu22.74.3-10.1ubuntu32.74.3-10.1ubuntu42.74.3-10.1ubuntu4.1
 None known
libsoup3
Ubuntu:25.10
 All versions, plus listed versions
3.6.5-13.6.5-1ubuntu13.6.5-33.6.5-43.6.5-4ubuntu0.13.6.5-4ubuntu0.2
 None known
libsoup2.4
Ubuntu:26.10
 All versions, plus listed versions
2.74.3-10.1ubuntu5
 None known
libsoup3
Ubuntu:26.10
 before 3.6.6-1ubuntu3, plus listed versions
3.6.6-1
3.6.6-1ubuntu3
libsoup2.4
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.74.3-10.1ubuntu42.74.3-10.1ubuntu5
 None known
libsoup3
Ubuntu:26.04:LTS
 before 3.6.6-1ubuntu0.1, plus listed versions
3.6.5-43.6.5-53.6.5-63.6.5-73.6.5-93.6.6-1
3.6.6-1ubuntu0.1
libsoup2.4
Ubuntu:Pro:16.04:LTS
From an advisory covering 8 CVEs
 before 2.52.2-1ubuntu0.3+esm8, plus listed versions
2.50.0-2debian12.52.1-12.52.2-12.52.2-1ubuntu0.12.52.2-1ubuntu0.2
Show 8 moreShow less
2.52.2-1ubuntu0.32.52.2-1ubuntu0.3+esm12.52.2-1ubuntu0.3+esm22.52.2-1ubuntu0.3+esm32.52.2-1ubuntu0.3+esm42.52.2-1ubuntu0.3+esm52.52.2-1ubuntu0.3+esm62.52.2-1ubuntu0.3+esm7
2.52.2-1ubuntu0.3+esm8
libsoup2.4
Ubuntu:Pro:18.04:LTS
From an advisory covering 8 CVEs
 before 2.62.1-1ubuntu0.4+esm9, plus listed versions
2.60.1-12.60.2-12.60.2-22.60.3-12.61.90-1
Show 13 moreShow less
2.62.0-12.62.1-12.62.1-1ubuntu0.12.62.1-1ubuntu0.32.62.1-1ubuntu0.42.62.1-1ubuntu0.4+esm12.62.1-1ubuntu0.4+esm22.62.1-1ubuntu0.4+esm32.62.1-1ubuntu0.4+esm42.62.1-1ubuntu0.4+esm52.62.1-1ubuntu0.4+esm62.62.1-1ubuntu0.4+esm72.62.1-1ubuntu0.4+esm8
2.62.1-1ubuntu0.4+esm9
libsoup2.4
Ubuntu:Pro:20.04:LTS
From an advisory covering 8 CVEs
 before 2.70.0-1ubuntu0.5+esm4, plus listed versions
2.68.2-0ubuntu12.68.2-12.68.2-22.68.2-2build22.69.90-1
Show 9 moreShow less
2.70.0-12.70.0-1ubuntu0.12.70.0-1ubuntu0.22.70.0-1ubuntu0.32.70.0-1ubuntu0.42.70.0-1ubuntu0.52.70.0-1ubuntu0.5+esm12.70.0-1ubuntu0.5+esm22.70.0-1ubuntu0.5+esm3
2.70.0-1ubuntu0.5+esm4
libsoup2.4
Ubuntu:22.04:LTS
From an advisory covering 8 CVEs
 before 2.74.2-3ubuntu0.9, plus listed versions
2.72.0-3ubuntu32.74.1-12.74.2-22.74.2-32.74.2-3ubuntu0.1
Show 7 moreShow less
2.74.2-3ubuntu0.22.74.2-3ubuntu0.32.74.2-3ubuntu0.42.74.2-3ubuntu0.52.74.2-3ubuntu0.62.74.2-3ubuntu0.72.74.2-3ubuntu0.8
2.74.2-3ubuntu0.9
libsoup3
Ubuntu:Pro:22.04:LTS
From an advisory covering 8 CVEs
 before 3.0.7-0ubuntu1+esm9, plus listed versions
3.0.4-23.0.4-33.0.5-13.0.7-0ubuntu13.0.7-0ubuntu1+esm1
Show 7 moreShow less
3.0.7-0ubuntu1+esm23.0.7-0ubuntu1+esm33.0.7-0ubuntu1+esm43.0.7-0ubuntu1+esm53.0.7-0ubuntu1+esm63.0.7-0ubuntu1+esm73.0.7-0ubuntu1+esm8
3.0.7-0ubuntu1+esm9
libsoup2.4
Ubuntu:24.04:LTS
From an advisory covering 8 CVEs
 before 2.74.3-6ubuntu1.9, plus listed versions
2.74.3-12.74.3-22.74.3-32.74.3-62.74.3-6build1
Show 9 moreShow less
2.74.3-6ubuntu12.74.3-6ubuntu1.12.74.3-6ubuntu1.22.74.3-6ubuntu1.32.74.3-6ubuntu1.42.74.3-6ubuntu1.52.74.3-6ubuntu1.62.74.3-6ubuntu1.72.74.3-6ubuntu1.8
2.74.3-6ubuntu1.9
libsoup3
Ubuntu:24.04:LTS
From an advisory covering 8 CVEs
 before 3.4.4-5ubuntu0.9, plus listed versions
3.4.2-43.4.4-13.4.4-23.4.4-43.4.4-5
Show 10 moreShow less
3.4.4-5build13.4.4-5build23.4.4-5ubuntu0.13.4.4-5ubuntu0.23.4.4-5ubuntu0.33.4.4-5ubuntu0.43.4.4-5ubuntu0.53.4.4-5ubuntu0.63.4.4-5ubuntu0.73.4.4-5ubuntu0.8
3.4.4-5ubuntu0.9
libsoup3
Ubuntu:26.04:LTS
From an advisory covering 8 CVEs
 before 3.6.6-1ubuntu0.1, plus listed versions
3.6.5-43.6.5-53.6.5-63.6.5-73.6.5-93.6.6-1
3.6.6-1ubuntu0.1
libsoup2.4
Ubuntu:Pro:26.04:LTS
From an advisory covering 8 CVEs
 before 2.74.3-10.1ubuntu5+esm3, plus listed versions
2.74.3-10.1ubuntu42.74.3-10.1ubuntu52.74.3-10.1ubuntu5+esm12.74.3-10.1ubuntu5+esm2
2.74.3-10.1ubuntu5+esm3
libsoup3
Ubuntu:26.10
From an advisory covering 8 CVEs
 before 3.6.6-1ubuntu3, plus listed versions
3.6.6-1
3.6.6-1ubuntu3

History

History
RecordedChangedSources
affectedCVE List, EUVD, NVD, OSV
affectedOSV
factsGitHub Advisories, OSV
referencesEUVD, NVD, OSV
referencesCVE List, GitHub Advisories
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-6324 is a medium vulnerability (CVSS 4.8) in Red Hat Enterprise Linux 10, published May 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.87%, the 59th percentile. Fixed in libsoup 3.4.4-16.

References

Show 21 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open