{"id":"CVE-2026-12478","aliases":["DEBIAN-CVE-2026-12478","EUVD-2026-43651","GHSA-6jpc-6452-qwq2","OESA-2026-3380","OESA-2026-3381","OESA-2026-3382","OESA-2026-3383","OESA-2026-3441","OESA-2026-3451","OESA-2026-3553","OESA-2026-3554","SUSE-SU-2026:22920-1","SUSE-SU-2026:23800-1","SUSE-SU-2026:4557-1","SUSE-SU-2026:4558-1","SUSE-SU-2026:4690-1","UBUNTU-CVE-2026-12478","USN-8975-1","openSUSE-SU-2026:11316-1","openSUSE-SU-2026:12084-1","openSUSE-SU-2026:21871-1"],"status":"published","title":"Libsoup: incomplete fix for cve-2026-0716: out-of-bounds read in libsoup websocket frame processing (unmasked path)","description":"The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00241,"percentile":0.15323,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-125"],"published":"2026-07-14T09:26:19Z","modified":"2026-11-05T17:18:03Z","exploits":[{"source":"pocgithub","id":"Popy21/security-research","title":"Popy21/security-research","date":"2026-08-01","url":"https://github.com/Popy21/security-research"}],"fixes":[{"ecosystem":"Debian:14","package":"libsoup3","fixed_in":["3.8.0-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"libsoup","fixed_in":["2.74.2-20.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"libsoup","fixed_in":["2.74.3-23.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"libsoup","fixed_in":["2.74.3-23.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"libsoup","fixed_in":["2.71.0-19.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"libsoup3","fixed_in":["3.4.5-21.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"libsoup3","fixed_in":["3.4.5-21.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"libsoup3","fixed_in":["3.4.5-21.oe2403sp4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"libsoup","fixed_in":["3.6.6-160000.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libsoup3","fixed_in":["3.0.7-0ubuntu1+esm10"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libsoup3","fixed_in":["3.4.4-5ubuntu0.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"libsoup3","fixed_in":["3.6.6-1ubuntu3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libsoup3","fixed_in":["3.6.6-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libsoup","fixed_in":["3.6.6-7.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"libsoup","fixed_in":["3.6.6-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:14","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-1"}]}],"versions":["3.6.5-3","3.6.5-4","3.6.5-5","3.6.5-6","3.6.5-7","3.6.5-8","3.6.5-9","3.6.6-1"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-20.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-23.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-23.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.71.0-19.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-21.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-24.oe2403sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-21.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-21.oe2403sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.52.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.52.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.52.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.52.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.52.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.52.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.52.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.52.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-150600.3.56.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-150600.3.56.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-150600.3.56.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.2-5.49.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.2-5.49.1"}]}],"bundled":14},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-0ubuntu1+esm10"}]}],"versions":["3.0.4-2","3.0.4-3","3.0.5-1","3.0.7-0ubuntu1","3.0.7-0ubuntu1+esm1","3.0.7-0ubuntu1+esm2","3.0.7-0ubuntu1+esm3","3.0.7-0ubuntu1+esm4","3.0.7-0ubuntu1+esm5","3.0.7-0ubuntu1+esm6","3.0.7-0ubuntu1+esm7","3.0.7-0ubuntu1+esm8","3.0.7-0ubuntu1+esm9"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-5ubuntu0.10"}]}],"versions":["3.4.2-4","3.4.4-1","3.4.4-2","3.4.4-4","3.4.4-5","3.4.4-5build1","3.4.4-5build2","3.4.4-5ubuntu0.1","3.4.4-5ubuntu0.2","3.4.4-5ubuntu0.3","3.4.4-5ubuntu0.4","3.4.4-5ubuntu0.5","3.4.4-5ubuntu0.6","3.4.4-5ubuntu0.7","3.4.4-5ubuntu0.8","3.4.4-5ubuntu0.9"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-1ubuntu3.1"}]}],"versions":["3.6.6-1","3.6.6-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-1ubuntu0.2"}]}],"versions":["3.6.5-4","3.6.5-5","3.6.5-6","3.6.5-7","3.6.5-9","3.6.6-1","3.6.6-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.2-1ubuntu0.3+esm9"}]}],"versions":["2.50.0-2debian1","2.52.1-1","2.52.2-1","2.52.2-1ubuntu0.1","2.52.2-1ubuntu0.2","2.52.2-1ubuntu0.3","2.52.2-1ubuntu0.3+esm1","2.52.2-1ubuntu0.3+esm2","2.52.2-1ubuntu0.3+esm3","2.52.2-1ubuntu0.3+esm4","2.52.2-1ubuntu0.3+esm5","2.52.2-1ubuntu0.3+esm6","2.52.2-1ubuntu0.3+esm7","2.52.2-1ubuntu0.3+esm8"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.1-1ubuntu0.4+esm10"}]}],"versions":["2.60.1-1","2.60.2-1","2.60.2-2","2.60.3-1","2.61.90-1","2.62.0-1","2.62.1-1","2.62.1-1ubuntu0.1","2.62.1-1ubuntu0.3","2.62.1-1ubuntu0.4","2.62.1-1ubuntu0.4+esm1","2.62.1-1ubuntu0.4+esm2","2.62.1-1ubuntu0.4+esm3","2.62.1-1ubuntu0.4+esm4","2.62.1-1ubuntu0.4+esm5","2.62.1-1ubuntu0.4+esm6","2.62.1-1ubuntu0.4+esm7","2.62.1-1ubuntu0.4+esm8","2.62.1-1ubuntu0.4+esm9"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.70.0-1ubuntu0.5+esm5"}]}],"versions":["2.68.2-0ubuntu1","2.68.2-1","2.68.2-2","2.68.2-2build2","2.69.90-1","2.70.0-1","2.70.0-1ubuntu0.1","2.70.0-1ubuntu0.2","2.70.0-1ubuntu0.3","2.70.0-1ubuntu0.4","2.70.0-1ubuntu0.5","2.70.0-1ubuntu0.5+esm1","2.70.0-1ubuntu0.5+esm2","2.70.0-1ubuntu0.5+esm3","2.70.0-1ubuntu0.5+esm4"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-3ubuntu0.10"}]}],"versions":["2.72.0-3ubuntu3","2.74.1-1","2.74.2-2","2.74.2-3","2.74.2-3ubuntu0.1","2.74.2-3ubuntu0.2","2.74.2-3ubuntu0.3","2.74.2-3ubuntu0.4","2.74.2-3ubuntu0.5","2.74.2-3ubuntu0.6","2.74.2-3ubuntu0.7","2.74.2-3ubuntu0.8","2.74.2-3ubuntu0.9"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-0ubuntu1+esm10"}]}],"versions":["3.0.4-2","3.0.4-3","3.0.5-1","3.0.7-0ubuntu1","3.0.7-0ubuntu1+esm1","3.0.7-0ubuntu1+esm2","3.0.7-0ubuntu1+esm3","3.0.7-0ubuntu1+esm4","3.0.7-0ubuntu1+esm5","3.0.7-0ubuntu1+esm6","3.0.7-0ubuntu1+esm7","3.0.7-0ubuntu1+esm8","3.0.7-0ubuntu1+esm9"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-6ubuntu1.10"}]}],"versions":["2.74.3-1","2.74.3-2","2.74.3-3","2.74.3-6","2.74.3-6build1","2.74.3-6ubuntu1","2.74.3-6ubuntu1.1","2.74.3-6ubuntu1.2","2.74.3-6ubuntu1.3","2.74.3-6ubuntu1.4","2.74.3-6ubuntu1.5","2.74.3-6ubuntu1.6","2.74.3-6ubuntu1.7","2.74.3-6ubuntu1.8","2.74.3-6ubuntu1.9"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-5ubuntu0.10"}]}],"versions":["3.4.2-4","3.4.4-1","3.4.4-2","3.4.4-4","3.4.4-5","3.4.4-5build1","3.4.4-5build2","3.4.4-5ubuntu0.1","3.4.4-5ubuntu0.2","3.4.4-5ubuntu0.3","3.4.4-5ubuntu0.4","3.4.4-5ubuntu0.5","3.4.4-5ubuntu0.6","3.4.4-5ubuntu0.7","3.4.4-5ubuntu0.8","3.4.4-5ubuntu0.9"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-1ubuntu3.1"}]}],"versions":["3.6.6-1","3.6.6-1ubuntu3"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-1ubuntu0.2"}]}],"versions":["3.6.5-4","3.6.5-5","3.6.5-6","3.6.5-7","3.6.5-9","3.6.6-1","3.6.6-1ubuntu0.1"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-10.1ubuntu5+esm4"}]}],"versions":["2.74.3-10.1ubuntu4","2.74.3-10.1ubuntu5","2.74.3-10.1ubuntu5+esm1","2.74.3-10.1ubuntu5+esm2","2.74.3-10.1ubuntu5+esm3"],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-7.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-24.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-160000.3.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-12478","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489655","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/518","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12478","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/cve-2026-0716","tags":["report"]},{"url":"https://github.com/advisories/GHSA-6jpc-6452-qwq2"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-12478","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3380","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3381","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3382","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3383","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3441","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3451","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2708","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3553","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3554","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622920-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271401","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12478","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623800-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264557-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271446","tags":["report"]},{"url":"https://bugzilla.suse.com/1271447","tags":["report"]},{"url":"https://bugzilla.suse.com/1271449","tags":["report"]},{"url":"https://bugzilla.suse.com/1272195","tags":["report"]},{"url":"https://bugzilla.suse.com/1273156","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66339","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264558-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264690-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271448","tags":["report"]},{"url":"https://bugzilla.suse.com/1283300","tags":["report"]},{"url":"https://bugzilla.suse.com/1283301","tags":["report"]},{"url":"https://bugzilla.suse.com/1283302","tags":["report"]},{"url":"https://bugzilla.suse.com/1283303","tags":["report"]},{"url":"https://bugzilla.suse.com/1283831","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-103399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15713","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-12478","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12478","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8975-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-12547","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-12548","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-102555","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-102556","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-102557","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-102558","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-102559","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-102560","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-103399","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102560","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-12478","title":"Libsoup: incomplete fix for cve-2026-0716: out-of-bounds read in libsoup websocket frame processing (unmasked path)","description":"The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.","status":"published","published":"2026-07-14T09:26:19.184Z","modified":"2026-11-05T17:02:42.793Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-05T18:54:21.089916Z"}],"euvd":[{"id":"EUVD-2026-43651","description":"The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.","status":"published","published":"2026-07-14T09:26:19Z","modified":"2026-11-05T17:02:42Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-05T18:00:57.218327Z"}],"ghsa":[{"id":"GHSA-6jpc-6452-qwq2","title":"The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard...","description":"The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.","status":"published","published":"2026-07-14T12:31:15Z","modified":"2026-07-14T12:31:15Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:09:27.031Z"}],"nvd":[{"id":"CVE-2026-12478","description":"The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.","status":"published","published":"2026-07-14T10:16:30.957Z","modified":"2026-11-05T17:18:03.917Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-05T19:55:55.702046Z"}],"osv":[{"id":"DEBIAN-CVE-2026-12478","description":"The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.","status":"published","published":"2026-07-14T10:16:30.957Z","modified":"2026-10-25T09:47:36.839499511Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:51.374409Z"},{"id":"OESA-2026-3380","title":"libsoup security update","description":"libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.\r\n\r\nSecurity Fix(es):\n\nThe fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.(CVE-2026-12478)","status":"published","published":"2026-08-13T14:02:09Z","modified":"2026-08-16T01:45:13.622813584Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3381","title":"libsoup security update","description":"libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.\r\n\r\nSecurity Fix(es):\n\nThe fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.(CVE-2026-12478)","status":"published","published":"2026-08-13T14:02:12Z","modified":"2026-08-16T01:45:14.888612701Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3382","title":"libsoup security update","description":"libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.\r\n\r\nSecurity Fix(es):\n\nThe fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.(CVE-2026-12478)","status":"published","published":"2026-08-13T14:02:13Z","modified":"2026-08-16T01:45:13.635873162Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3383","title":"libsoup security update","description":"libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.\r\n\r\nSecurity Fix(es):\n\nThe fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.(CVE-2026-12478)","status":"published","published":"2026-08-13T14:02:15Z","modified":"2026-08-16T01:45:13.632660909Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3441","title":"libsoup3 security update","description":"Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.\r\n\r\nSecurity Fix(es):\n\nThe fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.(CVE-2026-12478)","status":"published","published":"2026-08-20T09:58:12Z","modified":"2026-08-20T10:15:08.975097089Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3451","title":"libsoup security update","description":"libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.\r\n\r\nSecurity Fix(es):\n\nThe fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.(CVE-2026-12478)\n\nA request smuggling vulnerability exists in libsoup\u0026apos;s HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.(CVE-2026-2708)","status":"published","published":"2026-08-20T09:58:31Z","modified":"2026-08-20T10:15:11.962845254Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3553","title":"libsoup3 security update","description":"Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.\r\n\r\nSecurity Fix(es):\n\nThe fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.(CVE-2026-12478)","status":"published","published":"2026-08-30T04:16:29Z","modified":"2026-08-30T04:31:56.955251554Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3554","title":"libsoup3 security update","description":"Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.\r\n\r\nSecurity Fix(es):\n\nThe fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.(CVE-2026-12478)","status":"published","published":"2026-08-30T04:16:30Z","modified":"2026-08-30T04:31:50.599256048Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"UBUNTU-CVE-2026-12478","description":"The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.","status":"published","published":"2026-07-14T10:16:00Z","modified":"2026-11-04T03:30:03.867068459Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-04T03:56:45.249606Z"},{"id":"openSUSE-SU-2026:11316-1","title":"libsoup-3_0-0-3.6.6-7.1 on GA media","description":"These are all security issues fixed in the libsoup-3_0-0-3.6.6-7.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-20T00:00:00Z","modified":"2026-07-21T09:45:08.233986827Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:12084-1","title":"libsoup-2_4-1-2.74.3-24.1 on GA media","description":"These are all security issues fixed in the libsoup-2_4-1-2.74.3-24.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-08T00:00:00Z","modified":"2026-10-09T17:23:13.819472723Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:21871-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues\n\n- CVE-2026-0716: out-of-bounds read when processing a crafted unmasked frame with a payload length near `UINT64_MAX`\n  sent by a WebSocket server (bsc#1256418).\n","status":"published","published":"2026-09-17T07:56:20Z","modified":"2026-09-25T18:23:09.67897803Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:22920-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- Incomplete fix for CVE-2026-12478: out-of-bounds read in the `process_frame()` function of `SoupWebSocketConnection`\n  (bsc#1271401).\n","status":"published","published":"2026-07-24T08:10:59Z","modified":"2026-07-28T18:24:17.164383253Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:23800-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues\n\n- CVE-2026-0716: out-of-bounds read when processing a crafted unmasked frame with a payload length near `UINT64_MAX`\n  sent by a WebSocket server (bsc#1256418).\n","status":"published","published":"2026-09-17T07:53:35Z","modified":"2026-09-27T18:23:13.076113995Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:4557-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2026-12478: websocket: Fix out-of-bounds read when reading unmasked frame (bsc#1271401).\n- CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch\n  (bsc#1272195).\n- CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol\n  violation (bsc#1271446).\n- CVE-2026-15712: SoupClientMessageIOHTTP2: HTTP/2 GOAWAY frame parsing heap buffer over-read via invalid NUL-\n  termination assumption (bsc#1271447).\n- CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers via\n  an oversized multipart boundary string (bsc#1271449).\n- CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT tunnels\n  (bsc#1273156).\n","status":"published","published":"2026-10-07T08:50:59Z","modified":"2026-10-08T19:15:05.003072023Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4558-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2026-12478: websocket: Fix out-of-bounds read when reading unmasked frame (bsc#1271401).\n- CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch\n  (bsc#1272195).\n- CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol\n  violation (bsc#1271446).\n- CVE-2026-15712: SoupClientMessageIOHTTP2: HTTP/2 GOAWAY frame parsing heap buffer over-read via invalid NUL-\n  termination assumption (bsc#1271447).\n- CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers via\n  an oversized multipart boundary string (bsc#1271449).\n- CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT tunnels\n  (bsc#1273156).\n","status":"published","published":"2026-10-07T08:51:33Z","modified":"2026-10-08T19:15:03.7279804Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4690-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2026-12478: websocket: Fix out-of-bounds read when reading unmasked frame (bsc#1271401).\n- CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch\n  (bsc#1272195).\n- CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol\n  violation (bsc#1271446).\n- CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak\n  (bsc#1271448).\n- CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers via\n  an oversized multipart boundary string (bsc#1271449).\n- CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT tunnels\n  (bsc#1273156).\n- CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).\n- CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).\n- CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).\n- CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).\n- CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling\n  (bsc#1283831).\n","status":"published","published":"2026-10-16T08:41:55Z","modified":"2026-10-17T10:00:05.096101754Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"USN-8975-1","title":"libsoup2.4, libsoup3 vulnerabilities","description":"It was discovered that libsoup incorrectly handled certain WebSocket\nframes. A remote attacker could possibly use this issue to cause an\napplication to crash or expose sensitive information. This issue only\naffected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu\n26.10. (CVE-2026-12478)\n\nIt was discovered that libsoup incorrectly handled certain data URIs. A\nremote attacker could possibly use this issue to cause an application to\ncrash or expose sensitive information. This issue only affected Ubuntu\n22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10.\n(CVE-2026-102555)\n\nIt was discovered that libsoup incorrectly handled certain WebSocket\nmessages. A remote attacker could possibly use this issue to cause an\napplication to crash. This issue only affected Ubuntu 18.04 LTS, Ubuntu\n20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and\nUbuntu 26.10. (CVE-2026-102556)\n\nIt was discovered that libsoup incorrectly handled fragmented WebSocket\nmessages. A remote attacker could possibly use this issue to cause an\napplication to crash. (CVE-2026-102557)\n\nIt was discovered that libsoup incorrectly handled certain WebSocket\nframes. A remote attacker could possibly use this issue to cause an\napplication to crash. This issue only affected Ubuntu 18.04 LTS, Ubuntu\n20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and\nUbuntu 26.10. (CVE-2026-102558)\n\nIt was discovered that libsoup incorrectly handled large WebSocket\nmessages. An attacker could possibly use this issue to cause an\napplication to crash. (CVE-2026-102559)\n\nIt was discovered that libsoup incorrectly handled compressed WebSocket\nmessages. An attacker could possibly use this issue to cause an\napplication to crash. This issue only affected Ubuntu 20.04 LTS, Ubuntu\n22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10.\n(CVE-2026-102560)\n\nIt was discovered that libsoup did not properly handle certain HTTP\nrequests. A remote attacker could possibly use this issue to inject\narbitrary HTTP requests. (CVE-2026-103399)\n\nIt was discovered that libsoup incorrectly handled proxy credentials. A\nremote attacker could possibly use this issue to obtain sensitive\ninformation. (CVE-2026-12547)\n\nIt was discovered that libsoup incorrectly handled multipart messages. A\nremote attacker could possibly use this issue to cause an application to\ncrash or obtain sensitive information. (CVE-2026-12548)","status":"published","published":"2026-11-03T16:06:30Z","modified":"2026-11-04T03:43:15.637548273Z","updated_at":"2026-11-04T03:56:18.279609Z"}]}}