CVE-2025-32049

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.

Security Fix(es):

A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).(CVE-2025-32049)

A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soup_body_input_stream_read_chunked() function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.(CVE-2026-6324)

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.

Security Fix(es):

A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).(CVE-2025-32049)

A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soup_body_input_stream_read_chunked() function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.(CVE-2026-6324)

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.

Security Fix(es):

A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).(CVE-2025-32049)

A flaw was found in libsoup. The libsoup append_param_quoted() function may contain an overflow bug resulting in a buffer under-read.(CVE-2025-32050)

A flaw was found in libsoup. The libsoup soup_uri_decode_data_uri() function may crash when processing malformed data URI. This flaw allows an attacker to cause a denial of service (DoS).(CVE-2025-32051)

A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of service.(CVE-2025-32907)

A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine Transfer-Encoding: chunked and Connection: keep-alive headers. A remote, unauthenticated client can exploit this by sending specially crafted requests, causing SoupServer to fail to close the connection as required by RFC 9112. This allows the attacker to smuggle additional requests over the persistent connection, leading to unintended request processing and potential denial-of-service (DoS) conditions.(CVE-2026-1760)

A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the soup_server_disconnect() function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service.(CVE-2026-2436)

A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.(CVE-2026-2708)

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.

Security Fix(es):

A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).(CVE-2025-32049)

A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of service.(CVE-2025-32907)

A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the soup_server_disconnect() function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service.(CVE-2026-2436)

A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.(CVE-2026-2708)

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.

Security Fix(es):

A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).(CVE-2025-32049)

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.

Security Fix(es):

A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).(CVE-2025-32049)

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.

Security Fix(es):

A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).(CVE-2025-32049)

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via max_incoming_payload_size, it fails to track or limit memory allocation during decompression. A separate check for decompressed size (max_total_message_size) exists but executes only after inflation is complete, and it is entirely disabled by default for client connections. A remote, unauthenticated attacker can exploit this by sending a small, highly compressed payload (a decompression bomb), causing unbounded memory allocation that triggers an Out-of-Memory (OOM) crash and a Denial of Service (DoS).(CVE-2026-15709)

A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated attacker acting as a malicious network peer can trick the connection engine into allocating stream states that are subsequently leaked during cleanup. Over a sustained period, this flaw allows the remote attacker to consume the system's heap allocations incrementally, triggering a denial of service (DoS) through an ultimate Out-of-Memory (OOM) application crash.(CVE-2026-15713)

An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists in the soup_multipart_input_stream_read_headers() function inside soup-multipart-input-stream.c, which does not adequately restrict or validate the size of incoming multipart boundary strings. When processing a crafted HTTP response containing a malformed or oversized boundary parameter, the internal stream reader reads past the allocated buffer bounds. A remote, unauthenticated attacker can exploit this behavior to cause a service denial (DoS) through application failure or potentially read fragments of unauthorized memory metadata.(CVE-2026-15714)

A vulnerability classified as problematic has been found in GNOME libsoup (affected version unknown). CWE is classifying the issue as CWE-93. The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. This is going to have an impact on integrity. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2026-3633)

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.(CVE-2026-66339)

The libsoup packages provide an HTTP client and server library for GNOME.

Security Fix(es):

• libsoup: Heap buffer over-read in skip_insignificant_space when sniffing content (CVE-2025-2784)

• libsoup: Denial of Service attack to websocket server (CVE-2025-32049)

• libsoup: OOB Read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process (CVE-2025-32914)

• libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup (CVE-2025-4948)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

• libsoup: Denial of Service attack to websocket server (CVE-2025-32049)

• libsoup: Denial of service in server when client requests a large amount of overlapping ranges with Range header (CVE-2025-32907)

• libsoup: Cookie domain validation bypass via uppercase characters in libsoup (CVE-2025-4035)

• libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup (CVE-2025-4948)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The libsoup packages provide an HTTP client and server library for GNOME.

Security Fix(es):

• libsoup: Heap buffer over-read in skip_insignificant_space when sniffing content (CVE-2025-2784)

• libsoup: Denial of Service attack to websocket server (CVE-2025-32049)

• libsoup: OOB Read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process (CVE-2025-32914)

• libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup (CVE-2025-4948)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).

The libsoup packages provide an HTTP client and server library for GNOME.

Security Fix(es):

• libsoup: Heap buffer over-read in skip_insignificant_space when sniffing content (CVE-2025-2784)
• libsoup: Denial of Service attack to websocket server (CVE-2025-32049)
• libsoup: OOB Read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process (CVE-2025-32914)
• libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup (CVE-2025-4948)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

• libsoup: Denial of Service attack to websocket server (CVE-2025-32049)
• libsoup: Denial of service in server when client requests a large amount of overlapping ranges with Range header (CVE-2025-32907)
• libsoup: Cookie domain validation bypass via uppercase characters in libsoup (CVE-2025-4035)
• libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup (CVE-2025-4948)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The libsoup packages provide an HTTP client and server library for GNOME.

Security Fix(es):

• libsoup: Heap buffer over-read in skip_insignificant_space when sniffing content (CVE-2025-2784)
• libsoup: Denial of Service attack to websocket server (CVE-2025-32049)
• libsoup: OOB Read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process (CVE-2025-32914)
• libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup (CVE-2025-4948)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).

A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).

• CVE-2025-4948: fix integer underflow in soup_multipart_new_from_message()
• CVE-2025-32049: fix Denial of Service attack to websocket server
• CVE-2025-32914: fix OOB Read through soup_multipart_new_from_message()

• CVE-2025-4948: fix integer underflow in soup_multipart_new_from_message()
• CVE-2025-32049: fix Denial of Service attack to websocket server
• CVE-2025-32914: fix OOB Read through soup_multipart_new_from_message()

• CVE-2025-4948: fix integer underflow in soup_multipart_new_from_message()
• CVE-2025-32049: fix Denial of Service attack to websocket server
• CVE-2025-32914: fix OOB Read through soup_multipart_new_from_message()

• CVE-2025-32049: fix Denial of Service attack to websocket server

Libsoup: heap buffer over-read in skip_insignificant_space when sniffing content. (CVE-2025-2784) Libsoup: denial of service attack to websocket server. (CVE-2025-32049) Libsoup: integer overflow in append_param_quoted. (CVE-2025-32050) Libsoup: segmentation fault when parsing malformed data uri. (CVE-2025-32051) Libsoup: heap buffer overflow in sniff_unknown(). (CVE-2025-32052) Libsoup: heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space(). (CVE-2025-32053) Libsoup: out of bounds reads in soup_headers_parse_request(). (CVE-2025-32906) Libsoup: denial of service in server when client requests a large amount of overlapping ranges with range header. (CVE-2025-32907) Libsoup: denial of service on libsoup through http/2 server. (CVE-2025-32908) Libsoup: null pointer dereference on libsoup through function "sniff_mp4" in soup-content-sniffer.c. (CVE-2025-32909) Libsoup: null pointer deference on libsoup via /auth/soup-auth-digest.c through "soup_auth_digest_authenticate" on client when server omits the "realm" parameter in an unauthorized response with digest authentication. (CVE-2025-32910) Libsoup: double free on soup_message_headers_get_content_disposition() through "soup-message-headers.c" via "params" ghashtable value. (CVE-2025-32911) Libsoup: null pointer dereference in client when server omits the "nonce" parameter in an unauthorized response with digest authentication. (CVE-2025-32912) Libsoup: null pointer dereference in soup_message_headers_get_content_disposition when "filename" parameter is present, but has no value in content-disposition header. (CVE-2025-32913) Libsoup: oob read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process. (CVE-2025-32914) Libsoup: memory leak on soup_header_parse_quality_list() via soup-headers.c. (CVE-2025-46420) Libsoup: information disclosure may leads libsoup client sends authorization header to a different host when being redirected by a server. (CVE-2025-46421) Libsoup: null pointer dereference in libsoup may lead to denial of service. (CVE-2025-4476) Libsoup: integer overflow in cookie expiration date handling in libsoup. (CVE-2025-4945)

These are all security issues fixed in the libsoup-3_0-0-3.6.5-13.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libsoup-2_4-1-2.74.3-16.1 package on the GA media of openSUSE Tumbleweed.

This update for libsoup2 fixes the following issues:

• CVE-2025-4476: null pointer dereference may lead to denial of service (bsc#1243422).
• CVE-2025-14523: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (bsc#1254876).
• CVE-2025-32049: Denial of Service attack to websocket server (bsc#1240751).
• CVE-2026-0716: improper bounds handling may allow out-of-bounds read (bsc#1256418).
• CVE-2026-0719: stack-based buffer overflow in NTLM authentication can lead to arbitrary code execution (bsc#1256399).
• CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests (bsc#1257398).
• CVE-2026-1539: proxy authentication credentials leaked via the Proxy-Authorization header when handling HTTP redirects (bsc#1257441).
• CVE-2026-1760: improper handling of HTTP requests combining certain headers by SoupServer can lead to HTTP request smuggling and potential DoS (bsc#1257597).
• CVE-2026-2369: Buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

This update for libsoup fixes the following issues:

Update to libsoup 3.6.6:

• CVE-2025-12105: heap use-after-free in message queue handling during HTTP/2 read completion (bsc#1252555).
• CVE-2025-14523: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (bsc#1254876).
• CVE-2025-32049: Denial of Service attack to websocket server (bsc#1240751).
• CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests (bsc#1257398).
• CVE-2026-1539: proxy authentication credentials leaked via the Proxy-Authorization header when handling HTTP redirects (bsc#1257441).
• CVE-2026-1760: improper handling of HTTP requests combining certain headers by SoupServer can lead to HTTP request smuggling and potential DoS (bsc#1257597).
• CVE-2026-2369: Buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

Changelog:

• websocket: Fix out-of-bounds read in process_frame
• Check nulls returned by soup_date_time_new_from_http_string()
• Numerous fixes to handling of Range headers
• server: close the connection after responsing a request containing Content-Length and Transfer-Encoding
• Use CRLF as line boundary when parsing chunked enconding data
• websocket: do not accept messages frames after closing due to an error
• Sanitize filename of content disposition header values
• Always validate the headers value when coming from untrusted source
• uri-utils: do host validation when checking if a GUri is valid
• multipart: check length of bytes read soup_filter_input_stream_read_until()
• message-headers: Reject duplicate Host headers
• server: null-check soup_date_time_to_string()
• auth-digest: fix crash in soup_auth_digest_get_protection_space()
• session: fix 'heap-use-after-free' caused by 'finishing' queue item twice
• cookies: Avoid expires attribute if date is invalid
• http1: Set EOF flag once content-length bytes have been read
• date-utils: Add value checks for date/time parsing
• multipart: Fix multiple boundry limits
• Fixed multiple possible memory leaks
• message-headers: Correct merge of ranges
• body-input-stream: Correct chunked trailers end detection
• server-http2: Correctly validate URIs
• multipart: Fix read out of buffer bounds under soup_multipart_new_from_message()
• headers: Ensure Request-Line comprises entire first line
• tests: Fix MSVC build error
• Fix possible deadlock on init from gmodule usage
• Updated translations.

Root has patched CVE-2025-32049 in the libsoup2.4 package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2025-32049 in the libsoup3 package for Root:Debian:13. Multiple fixed versions available.

This update for libsoup2 fixes the following issues:

• CVE-2025-32049: denial of Service attack to websocket server (bsc#1240751).
• CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

This update for libsoup fixes the following issues:

• CVE-2025-32049: denial of Service attack to websocket server (bsc#1240751).
• CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

This update for libsoup fixes the following issues:

• CVE-2025-32049: denial of Service attack to websocket server (bsc#1240751).
• CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

This update for libsoup fixes the following issues:

• CVE-2025-32049: denial of Service attack to websocket server (bsc#1240751).
• CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

This update for libsoup fixes the following issues:

• CVE-2026-0716: improper bounds handling may allow out-of-bounds read (bsc#1256418).
• CVE-2025-4476: null pointer dereference may lead to denial of service (bsc#1243422).
• CVE-2025-32049: denial of Service attack to websocket server (bsc#1240751).
• CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

This update for libsoup2 fixes the following issues:

• CVE-2025-32049: denial of service attack to websocket server (bsc#1240751).
• CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests (bsc#1257398).
• CVE-2026-1539: proxy authentication credentials leaked via the Proxy-Authorization header when handling HTTP redirects (bsc#1257441).
• CVE-2026-1760: improper handling of HTTP requests combining certain headers by SoupServer can lead to HTTP request smuggling and potential DoS (bsc#1257597).
• CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

This update for libsoup fixes the following issues:

• CVE-2025-12105: Fixed heap use-after-free in message queue handling during HTTP/2 read completion. (bsc#1252555)
• CVE-2025-32049: Fixed a Denial of Service attack to websocket server. (bsc#1240751)
• CVE-2026-2443: Fixed an out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers. (bsc#1258170)
• CVE-2026-2369: Fixed a buffer overread due to integer underflow when handling zero-length resources. (bsc#1258120)
• CVE-2026-2708: Fixed HTTP request smuggling via duplicate Content-Length headers. (bsc#1258508)

This update for libsoup fixes the following issues:

• CVE-2025-32049: denial of service attack to websocket server (bsc#1240751).
• CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests (bsc#1257398).
• CVE-2026-1536: HTTP header injection or response splitting via CRLF injection in the Content-Disposition header (bsc#1257440).
• CVE-2026-1539: proxy authentication credentials leaked via the Proxy-Authorization header when handling HTTP redirects (bsc#1257441).
• CVE-2026-1760: improper handling of HTTP requests combining certain headers by SoupServer can lead to HTTP request smuggling and potential DoS (bsc#1257597).
• CVE-2026-1761: incorrect length calculation when parsing of multipart HTTP responses can lead to a stack-based buffer overflow (bsc#1257598).
• CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

This update for libsoup fixes the following issues:

Update to libsoup 3.6.6:

• CVE-2025-12105: heap use-after-free in message queue handling during HTTP/2 read completion (bsc#1252555).
• CVE-2025-14523: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (bsc#1254876).
• CVE-2025-32049: Denial of Service attack to websocket server (bsc#1240751).
• CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests (bsc#1257398).
• CVE-2026-1539: proxy authentication credentials leaked via the Proxy-Authorization header when handling HTTP redirects (bsc#1257441).
• CVE-2026-1760: improper handling of HTTP requests combining certain headers by SoupServer can lead to HTTP request smuggling and potential DoS (bsc#1257597).
• CVE-2026-2369: Buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
• CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
• CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

Changelog:

• websocket: Fix out-of-bounds read in process_frame
• Check nulls returned by soup_date_time_new_from_http_string()
• Numerous fixes to handling of Range headers
• server: close the connection after responsing a request containing Content-Length and Transfer-Encoding
• Use CRLF as line boundary when parsing chunked enconding data
• websocket: do not accept messages frames after closing due to an error
• Sanitize filename of content disposition header values
• Always validate the headers value when coming from untrusted source
• uri-utils: do host validation when checking if a GUri is valid
• multipart: check length of bytes read soup_filter_input_stream_read_until()
• message-headers: Reject duplicate Host headers
• server: null-check soup_date_time_to_string()
• auth-digest: fix crash in soup_auth_digest_get_protection_space()
• session: fix 'heap-use-after-free' caused by 'finishing' queue item twice
• cookies: Avoid expires attribute if date is invalid
• http1: Set EOF flag once content-length bytes have been read
• date-utils: Add value checks for date/time parsing
• multipart: Fix multiple boundry limits
• Fixed multiple possible memory leaks
• message-headers: Correct merge of ranges
• body-input-stream: Correct chunked trailers end detection
• server-http2: Correctly validate URIs
• multipart: Fix read out of buffer bounds under soup_multipart_new_from_message()
• headers: Ensure Request-Line comprises entire first line
• tests: Fix MSVC build error
• Fix possible deadlock on init from gmodule usage
• Updated translations.