{"id":"CVE-2026-103399","aliases":["AZL-105543","DEBIAN-CVE-2026-103399","EUVD-2026-90226","GHSA-mfgq-q7gx-p678","SUSE-SU-2026:24368-1","SUSE-SU-2026:24470-1","SUSE-SU-2026:4690-1","SUSE-SU-2026:4703-1","SUSE-SU-2026:4739-1","SUSE-SU-2026:5062-1","SUSE-SU-2026:5063-1","UBUNTU-CVE-2026-103399","USN-8975-1","openSUSE-SU-2026:12132-1","openSUSE-SU-2026:22181-1"],"status":"published","title":"Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body","description":"A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled request, leading to unintended request handling.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00246,"percentile":0.15954,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2026-09-30T17:42:31Z","modified":"2026-11-05T16:17:24Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libsoup","fixed_in":["3.4.4-150600.3.62.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libsoup","fixed_in":["3.4.4-150600.3.62.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libsoup","fixed_in":["3.4.4-150600.3.62.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libsoup","fixed_in":["3.0.4-150400.3.58.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libsoup","fixed_in":["3.0.4-150400.3.58.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libsoup","fixed_in":["3.0.4-150400.3.58.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libsoup","fixed_in":["3.0.4-150400.3.58.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libsoup","fixed_in":["3.0.4-150400.3.58.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libsoup","fixed_in":["3.0.4-150400.3.58.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libsoup","fixed_in":["3.0.4-150400.3.58.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libsoup","fixed_in":["3.0.4-150400.3.58.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libsoup2.4","fixed_in":["2.52.2-1ubuntu0.3+esm9"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libsoup2.4","fixed_in":["2.62.1-1ubuntu0.4+esm10"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libsoup2.4","fixed_in":["2.70.0-1ubuntu0.5+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libsoup2.4","fixed_in":["2.74.2-3ubuntu0.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libsoup3","fixed_in":["3.0.7-0ubuntu1+esm10"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libsoup2.4","fixed_in":["2.74.3-6ubuntu1.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libsoup3","fixed_in":["3.4.4-5ubuntu0.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"libsoup3","fixed_in":["3.6.6-1ubuntu3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libsoup3","fixed_in":["3.6.6-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"libsoup2.4","fixed_in":["2.74.3-10.1ubuntu5+esm4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.4.4-18"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.74.3-1","2.74.3-1+deb12u1","2.74.3-10","2.74.3-10.1","2.74.3-11","2.74.3-2","2.74.3-3","2.74.3-3.1~exp1","2.74.3-3.1~exp2","2.74.3-3.1~exp3","2.74.3-5","2.74.3-6","2.74.3-7","2.74.3-8","2.74.3-8.1","2.74.3-9"]},{"source":"osv","ecosystem":"Debian:13","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.74.3-10.1","2.74.3-11"]},{"source":"osv","ecosystem":"Debian:12","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.2-2","3.2.3-0+deb12u1","3.2.3-0+deb12u2","3.3.1-1","3.4.0-1","3.4.1-1","3.4.2-1","3.4.2-2","3.4.2-3","3.4.2-4","3.4.3-1","3.4.4-1","3.4.4-2","3.4.4-3","3.4.4-4","3.4.4-5","3.5.2-1","3.6.0-1","3.6.0-2","3.6.0-3","3.6.0-4","3.6.1-1","3.6.4-1","3.6.4-2","3.6.4-3","3.6.5-1","3.6.5-2","3.6.5-3","3.6.5-4","3.6.5-5","3.6.5-6","3.6.5-7","3.6.5-8","3.6.5-9","3.6.6-1","3.8.0-1","3.8.0-2","3.8.0-3"]},{"source":"osv","ecosystem":"Debian:13","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.5-3","3.6.5-4","3.6.5-5","3.6.5-6","3.6.5-7","3.6.5-8","3.6.5-9","3.6.6-1","3.8.0-1","3.8.0-2","3.8.0-3"]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-159998.1.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-160000.5.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-160000.5.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.2-5.49.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.2-5.49.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150600.4.42.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150600.4.42.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150600.4.42.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-150600.3.62.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-150600.3.62.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-150600.3.62.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.58.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.58.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.58.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.58.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.58.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.58.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.58.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.58.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.2-1ubuntu0.3+esm9"}]}],"versions":["2.50.0-2debian1","2.52.1-1","2.52.2-1","2.52.2-1ubuntu0.1","2.52.2-1ubuntu0.2","2.52.2-1ubuntu0.3","2.52.2-1ubuntu0.3+esm1","2.52.2-1ubuntu0.3+esm2","2.52.2-1ubuntu0.3+esm3","2.52.2-1ubuntu0.3+esm4","2.52.2-1ubuntu0.3+esm5","2.52.2-1ubuntu0.3+esm6","2.52.2-1ubuntu0.3+esm7","2.52.2-1ubuntu0.3+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.1-1ubuntu0.4+esm10"}]}],"versions":["2.60.1-1","2.60.2-1","2.60.2-2","2.60.3-1","2.61.90-1","2.62.0-1","2.62.1-1","2.62.1-1ubuntu0.1","2.62.1-1ubuntu0.3","2.62.1-1ubuntu0.4","2.62.1-1ubuntu0.4+esm1","2.62.1-1ubuntu0.4+esm2","2.62.1-1ubuntu0.4+esm3","2.62.1-1ubuntu0.4+esm4","2.62.1-1ubuntu0.4+esm5","2.62.1-1ubuntu0.4+esm6","2.62.1-1ubuntu0.4+esm7","2.62.1-1ubuntu0.4+esm8","2.62.1-1ubuntu0.4+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.70.0-1ubuntu0.5+esm5"}]}],"versions":["2.68.2-0ubuntu1","2.68.2-1","2.68.2-2","2.68.2-2build2","2.69.90-1","2.70.0-1","2.70.0-1ubuntu0.1","2.70.0-1ubuntu0.2","2.70.0-1ubuntu0.3","2.70.0-1ubuntu0.4","2.70.0-1ubuntu0.5","2.70.0-1ubuntu0.5+esm1","2.70.0-1ubuntu0.5+esm2","2.70.0-1ubuntu0.5+esm3","2.70.0-1ubuntu0.5+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-3ubuntu0.10"}]}],"versions":["2.72.0-3ubuntu3","2.74.1-1","2.74.2-2","2.74.2-3","2.74.2-3ubuntu0.1","2.74.2-3ubuntu0.2","2.74.2-3ubuntu0.3","2.74.2-3ubuntu0.4","2.74.2-3ubuntu0.5","2.74.2-3ubuntu0.6","2.74.2-3ubuntu0.7","2.74.2-3ubuntu0.8","2.74.2-3ubuntu0.9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-0ubuntu1+esm10"}]}],"versions":["3.0.4-2","3.0.4-3","3.0.5-1","3.0.7-0ubuntu1","3.0.7-0ubuntu1+esm1","3.0.7-0ubuntu1+esm2","3.0.7-0ubuntu1+esm3","3.0.7-0ubuntu1+esm4","3.0.7-0ubuntu1+esm5","3.0.7-0ubuntu1+esm6","3.0.7-0ubuntu1+esm7","3.0.7-0ubuntu1+esm8","3.0.7-0ubuntu1+esm9"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-6ubuntu1.10"}]}],"versions":["2.74.3-1","2.74.3-2","2.74.3-3","2.74.3-6","2.74.3-6build1","2.74.3-6ubuntu1","2.74.3-6ubuntu1.1","2.74.3-6ubuntu1.2","2.74.3-6ubuntu1.3","2.74.3-6ubuntu1.4","2.74.3-6ubuntu1.5","2.74.3-6ubuntu1.6","2.74.3-6ubuntu1.7","2.74.3-6ubuntu1.8","2.74.3-6ubuntu1.9"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-5ubuntu0.10"}]}],"versions":["3.4.2-4","3.4.4-1","3.4.4-2","3.4.4-4","3.4.4-5","3.4.4-5build1","3.4.4-5build2","3.4.4-5ubuntu0.1","3.4.4-5ubuntu0.2","3.4.4-5ubuntu0.3","3.4.4-5ubuntu0.4","3.4.4-5ubuntu0.5","3.4.4-5ubuntu0.6","3.4.4-5ubuntu0.7","3.4.4-5ubuntu0.8","3.4.4-5ubuntu0.9"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.74.3-10.1ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-1ubuntu3.1"}]}],"versions":["3.6.6-1","3.6.6-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-1ubuntu0.2"}]}],"versions":["3.6.5-4","3.6.5-5","3.6.5-6","3.6.5-7","3.6.5-9","3.6.6-1","3.6.6-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-10.1ubuntu5+esm4"}]}],"versions":["2.74.3-10.1ubuntu4","2.74.3-10.1ubuntu5","2.74.3-10.1ubuntu5+esm1","2.74.3-10.1ubuntu5+esm2","2.74.3-10.1ubuntu5+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.2-1ubuntu0.3+esm9"}]}],"versions":["2.50.0-2debian1","2.52.1-1","2.52.2-1","2.52.2-1ubuntu0.1","2.52.2-1ubuntu0.2","2.52.2-1ubuntu0.3","2.52.2-1ubuntu0.3+esm1","2.52.2-1ubuntu0.3+esm2","2.52.2-1ubuntu0.3+esm3","2.52.2-1ubuntu0.3+esm4","2.52.2-1ubuntu0.3+esm5","2.52.2-1ubuntu0.3+esm6","2.52.2-1ubuntu0.3+esm7","2.52.2-1ubuntu0.3+esm8"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.1-1ubuntu0.4+esm10"}]}],"versions":["2.60.1-1","2.60.2-1","2.60.2-2","2.60.3-1","2.61.90-1","2.62.0-1","2.62.1-1","2.62.1-1ubuntu0.1","2.62.1-1ubuntu0.3","2.62.1-1ubuntu0.4","2.62.1-1ubuntu0.4+esm1","2.62.1-1ubuntu0.4+esm2","2.62.1-1ubuntu0.4+esm3","2.62.1-1ubuntu0.4+esm4","2.62.1-1ubuntu0.4+esm5","2.62.1-1ubuntu0.4+esm6","2.62.1-1ubuntu0.4+esm7","2.62.1-1ubuntu0.4+esm8","2.62.1-1ubuntu0.4+esm9"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.70.0-1ubuntu0.5+esm5"}]}],"versions":["2.68.2-0ubuntu1","2.68.2-1","2.68.2-2","2.68.2-2build2","2.69.90-1","2.70.0-1","2.70.0-1ubuntu0.1","2.70.0-1ubuntu0.2","2.70.0-1ubuntu0.3","2.70.0-1ubuntu0.4","2.70.0-1ubuntu0.5","2.70.0-1ubuntu0.5+esm1","2.70.0-1ubuntu0.5+esm2","2.70.0-1ubuntu0.5+esm3","2.70.0-1ubuntu0.5+esm4"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-3ubuntu0.10"}]}],"versions":["2.72.0-3ubuntu3","2.74.1-1","2.74.2-2","2.74.2-3","2.74.2-3ubuntu0.1","2.74.2-3ubuntu0.2","2.74.2-3ubuntu0.3","2.74.2-3ubuntu0.4","2.74.2-3ubuntu0.5","2.74.2-3ubuntu0.6","2.74.2-3ubuntu0.7","2.74.2-3ubuntu0.8","2.74.2-3ubuntu0.9"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-0ubuntu1+esm10"}]}],"versions":["3.0.4-2","3.0.4-3","3.0.5-1","3.0.7-0ubuntu1","3.0.7-0ubuntu1+esm1","3.0.7-0ubuntu1+esm2","3.0.7-0ubuntu1+esm3","3.0.7-0ubuntu1+esm4","3.0.7-0ubuntu1+esm5","3.0.7-0ubuntu1+esm6","3.0.7-0ubuntu1+esm7","3.0.7-0ubuntu1+esm8","3.0.7-0ubuntu1+esm9"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-6ubuntu1.10"}]}],"versions":["2.74.3-1","2.74.3-2","2.74.3-3","2.74.3-6","2.74.3-6build1","2.74.3-6ubuntu1","2.74.3-6ubuntu1.1","2.74.3-6ubuntu1.2","2.74.3-6ubuntu1.3","2.74.3-6ubuntu1.4","2.74.3-6ubuntu1.5","2.74.3-6ubuntu1.6","2.74.3-6ubuntu1.7","2.74.3-6ubuntu1.8","2.74.3-6ubuntu1.9"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-5ubuntu0.10"}]}],"versions":["3.4.2-4","3.4.4-1","3.4.4-2","3.4.4-4","3.4.4-5","3.4.4-5build1","3.4.4-5build2","3.4.4-5ubuntu0.1","3.4.4-5ubuntu0.2","3.4.4-5ubuntu0.3","3.4.4-5ubuntu0.4","3.4.4-5ubuntu0.5","3.4.4-5ubuntu0.6","3.4.4-5ubuntu0.7","3.4.4-5ubuntu0.8","3.4.4-5ubuntu0.9"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-1ubuntu3.1"}]}],"versions":["3.6.6-1","3.6.6-1ubuntu3"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-1ubuntu0.2"}]}],"versions":["3.6.5-4","3.6.5-5","3.6.5-6","3.6.5-7","3.6.5-9","3.6.6-1","3.6.6-1ubuntu0.1"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-10.1ubuntu5+esm4"}]}],"versions":["2.74.3-10.1ubuntu4","2.74.3-10.1ubuntu5","2.74.3-10.1ubuntu5+esm1","2.74.3-10.1ubuntu5+esm2","2.74.3-10.1ubuntu5+esm3"],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-160000.5.1"}]}],"bundled":14}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-103399","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543949","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103399","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mfgq-q7gx-p678"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-103399","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624368-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271446","tags":["report"]},{"url":"https://bugzilla.suse.com/1271447","tags":["report"]},{"url":"https://bugzilla.suse.com/1271448","tags":["report"]},{"url":"https://bugzilla.suse.com/1271449","tags":["report"]},{"url":"https://bugzilla.suse.com/1272195","tags":["report"]},{"url":"https://bugzilla.suse.com/1272196","tags":["report"]},{"url":"https://bugzilla.suse.com/1273156","tags":["report"]},{"url":"https://bugzilla.suse.com/1283299","tags":["report"]},{"url":"https://bugzilla.suse.com/1283300","tags":["report"]},{"url":"https://bugzilla.suse.com/1283301","tags":["report"]},{"url":"https://bugzilla.suse.com/1283302","tags":["report"]},{"url":"https://bugzilla.suse.com/1283303","tags":["report"]},{"url":"https://bugzilla.suse.com/1283304","tags":["report"]},{"url":"https://bugzilla.suse.com/1283831","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-103399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66339","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624470-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264690-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271401","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12478","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1539","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264703-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1275988","tags":["report"]},{"url":"https://bugzilla.suse.com/1276759","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77680","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264739-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265062-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265063-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-103399","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-103399","tags":["report"]},{"url":"https://gitlab.gnome.org/GNOME/libsoup/-/work_items/539","tags":["report"]},{"url":"https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/560","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8975-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-12478","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-12547","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-12548","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-102555","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-102556","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-102557","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-102558","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-102559","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-102560","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-103399","title":"Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body","description":"A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled request, leading to unintended request handling.","status":"published","published":"2026-09-30T17:42:31.307Z","modified":"2026-11-05T15:52:20.613Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-444"],"updated_at":"2026-11-05T16:36:33.176634Z"}],"euvd":[{"id":"EUVD-2026-90226","description":"A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled request, leading to unintended request handling.","status":"published","published":"2026-09-30T17:42:31Z","modified":"2026-11-05T15:52:20Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T18:00:59.460287Z"}],"ghsa":[{"id":"GHSA-mfgq-q7gx-p678","title":"A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect:...","description":"A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled request, leading to unintended request handling.","status":"published","published":"2026-09-30T18:33:50Z","modified":"2026-09-30T18:33:56Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:12:38.152609Z"}],"nvd":[{"id":"CVE-2026-103399","description":"A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled request, leading to unintended request handling.","status":"published","published":"2026-09-30T18:18:16.137Z","modified":"2026-11-05T16:17:24.323Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-444"],"updated_at":"2026-11-05T19:56:00.556424Z"}],"osv":[{"id":"DEBIAN-CVE-2026-103399","description":"A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled request, leading to unintended request handling.","status":"published","published":"2026-09-30T18:18:16.137Z","modified":"2026-10-31T16:00:11.561109639Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:48.903138Z"},{"id":"UBUNTU-CVE-2026-103399","description":"A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled request, leading to unintended request handling.","status":"published","published":"2026-09-30T18:18:00Z","modified":"2026-11-04T03:30:17.85842536Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-04T03:56:39.110241Z"},{"id":"AZL-105543","title":"CVE-2026-103399 affecting package libsoup 3.4.4-18","description":"A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled request, leading to unintended request handling.","status":"published","published":"2026-09-30T18:18:16Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.719431Z"},{"id":"openSUSE-SU-2026:12132-1","title":"libsoup-2_4-1-2.74.3-25.1 on GA media","description":"These are all security issues fixed in the libsoup-2_4-1-2.74.3-25.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-14T00:00:00Z","modified":"2026-10-15T17:23:12.96817339Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22181-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2026-12547: Header \"Proxy-Authorization\" leads to credentials being send to different proxy after proxy switch\n  (bsc#1272195).\n- CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation (bsc#1272196).\n- CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol\n  violation (bsc#1271446).\n- CVE-2026-15712: SoupClientMessageIOHTTP2: HTTP/2 GOAWAY frame parsing heap buffer over-read via invalid NUL-\n  termination assumption (bsc#1271447).\n- CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak\n  (bsc#1271448).\n- CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers\n  via an oversized multipart boundary string (bsc#1271449).\n- CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT tunnels\n  (bsc#1273156).\n- CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding (bsc#1283299).\n- CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).\n- CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).\n- CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).\n- CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).\n- CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).\n- CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling\n  (bsc#1283831).\n","status":"published","published":"2026-10-29T10:24:12Z","modified":"2026-10-31T18:00:09.296668455Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:24368-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2026-12547: Header \"Proxy-Authorization\" leads to credentials being send to different proxy after proxy switch\n  (bsc#1272195).\n- CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation (bsc#1272196).\n- CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol\n  violation (bsc#1271446).\n- CVE-2026-15712: SoupClientMessageIOHTTP2: HTTP/2 GOAWAY frame parsing heap buffer over-read via invalid NUL-\n  termination assumption (bsc#1271447).\n- CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak\n  (bsc#1271448).\n- CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers\n  via an oversized multipart boundary string (bsc#1271449).\n- CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT tunnels\n  (bsc#1273156).\n- CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding (bsc#1283299).\n- CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).\n- CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).\n- CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).\n- CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).\n- CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).\n- CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling\n  (bsc#1283831).\n","status":"published","published":"2026-10-21T08:56:44Z","modified":"2026-10-27T17:23:18.80097485Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24470-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2026-12547: Header \"Proxy-Authorization\" leads to credentials being send to different proxy after proxy switch\n  (bsc#1272195).\n- CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation (bsc#1272196).\n- CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol\n  violation (bsc#1271446).\n- CVE-2026-15712: SoupClientMessageIOHTTP2: HTTP/2 GOAWAY frame parsing heap buffer over-read via invalid NUL-\n  termination assumption (bsc#1271447).\n- CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak\n  (bsc#1271448).\n- CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers\n  via an oversized multipart boundary string (bsc#1271449).\n- CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT tunnels\n  (bsc#1273156).\n- CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding (bsc#1283299).\n- CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).\n- CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).\n- CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).\n- CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).\n- CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).\n- CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling\n  (bsc#1283831).\n","status":"published","published":"2026-10-29T10:24:20Z","modified":"2026-11-04T17:23:18.62343932Z","updated_at":"2026-11-04T17:43:22.558805Z"},{"id":"SUSE-SU-2026:4690-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2026-12478: websocket: Fix out-of-bounds read when reading unmasked frame (bsc#1271401).\n- CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch\n  (bsc#1272195).\n- CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol\n  violation (bsc#1271446).\n- CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak\n  (bsc#1271448).\n- CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers via\n  an oversized multipart boundary string (bsc#1271449).\n- CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT tunnels\n  (bsc#1273156).\n- CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).\n- CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).\n- CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).\n- CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).\n- CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling\n  (bsc#1283831).\n","status":"published","published":"2026-10-16T08:41:55Z","modified":"2026-10-17T10:00:05.096101754Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4703-1","title":"Security update for libsoup2","description":"This update for libsoup2 fixes the following issues:\n\n- CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch\n  (bsc#1272195).\n- CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol\n  violation (bsc#1271446).\n- CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak\n  (bsc#1271448).\n- CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers via\n  an oversized multipart boundary string (bsc#1271449).\n- CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT tunnels\n  (bsc#1273156).\n- CVE-2026-77014: Integer truncation in sort_ranges() comparator causes silent omission of HTTP Range responses\n  (bsc#1275988).\n- CVE-2026-77680: quadratic CPU denial of service in HTTP Range coalescing after the CVE-2025-32907 fix (bsc#1276759).\n- CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).\n- CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).\n- CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).\n- CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).\n- CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).\n- CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling\n  (bsc#1283831).\n","status":"published","published":"2026-10-16T13:29:46Z","modified":"2026-10-17T10:00:04.12517112Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4739-1","title":"Security update for libsoup2","description":"This update for libsoup2 fixes the following issues:\n\n- CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch\n  (bsc#1272195).\n- CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol\n  violation (bsc#1271446).\n- CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak\n  (bsc#1271448).\n- CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers via\n  an oversized multipart boundary string (bsc#1271449).\n- CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT tunnels\n  (bsc#1273156).\n- CVE-2026-77014: Integer truncation in sort_ranges() comparator causes silent omission of HTTP Range responses\n  (bsc#1275988).\n- CVE-2026-77680: quadratic CPU denial of service in HTTP Range coalescing after the CVE-2025-32907 fix (bsc#1276759).\n- CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).\n- CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).\n- CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).\n- CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).\n- CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).\n- CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling\n  (bsc#1283831).\n","status":"published","published":"2026-10-19T12:59:37Z","modified":"2026-10-20T10:45:04.185304919Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:5062-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issue:\n\n- CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling\n  (bsc#1283831).\n","status":"published","published":"2026-11-03T07:30:13Z","modified":"2026-11-03T22:45:05.16241677Z","updated_at":"2026-11-03T22:59:30.419462Z"},{"id":"SUSE-SU-2026:5063-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issue:\n\n- CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling\n  (bsc#1283831).\n","status":"published","published":"2026-11-03T07:31:08Z","modified":"2026-11-03T22:45:04.231649762Z","updated_at":"2026-11-03T22:59:30.419462Z"},{"id":"USN-8975-1","title":"libsoup2.4, libsoup3 vulnerabilities","description":"It was discovered that libsoup incorrectly handled certain WebSocket\nframes. A remote attacker could possibly use this issue to cause an\napplication to crash or expose sensitive information. This issue only\naffected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu\n26.10. (CVE-2026-12478)\n\nIt was discovered that libsoup incorrectly handled certain data URIs. A\nremote attacker could possibly use this issue to cause an application to\ncrash or expose sensitive information. This issue only affected Ubuntu\n22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10.\n(CVE-2026-102555)\n\nIt was discovered that libsoup incorrectly handled certain WebSocket\nmessages. A remote attacker could possibly use this issue to cause an\napplication to crash. This issue only affected Ubuntu 18.04 LTS, Ubuntu\n20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and\nUbuntu 26.10. (CVE-2026-102556)\n\nIt was discovered that libsoup incorrectly handled fragmented WebSocket\nmessages. A remote attacker could possibly use this issue to cause an\napplication to crash. (CVE-2026-102557)\n\nIt was discovered that libsoup incorrectly handled certain WebSocket\nframes. A remote attacker could possibly use this issue to cause an\napplication to crash. This issue only affected Ubuntu 18.04 LTS, Ubuntu\n20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and\nUbuntu 26.10. (CVE-2026-102558)\n\nIt was discovered that libsoup incorrectly handled large WebSocket\nmessages. An attacker could possibly use this issue to cause an\napplication to crash. (CVE-2026-102559)\n\nIt was discovered that libsoup incorrectly handled compressed WebSocket\nmessages. An attacker could possibly use this issue to cause an\napplication to crash. This issue only affected Ubuntu 20.04 LTS, Ubuntu\n22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10.\n(CVE-2026-102560)\n\nIt was discovered that libsoup did not properly handle certain HTTP\nrequests. A remote attacker could possibly use this issue to inject\narbitrary HTTP requests. (CVE-2026-103399)\n\nIt was discovered that libsoup incorrectly handled proxy credentials. A\nremote attacker could possibly use this issue to obtain sensitive\ninformation. (CVE-2026-12547)\n\nIt was discovered that libsoup incorrectly handled multipart messages. A\nremote attacker could possibly use this issue to cause an application to\ncrash or obtain sensitive information. (CVE-2026-12548)","status":"published","published":"2026-11-03T16:06:30Z","modified":"2026-11-04T03:43:15.637548273Z","updated_at":"2026-11-04T03:56:18.279609Z"}]}}