{"id":"CVE-2026-12548","aliases":["CLSA-2026-1788856994","CLSA-2026-1788859279","DEBIAN-CVE-2026-12548","EUVD-2026-46363","GHSA-wmh6-vpqv-v8q3","OESA-2026-3690","OESA-2026-3691","OESA-2026-3692","OESA-2026-3693","OESA-2026-3694","OESA-2026-3695","OESA-2026-3782","OESA-2026-3825","SUSE-SU-2026:24368-1","SUSE-SU-2026:24470-1","SUSE-SU-2026:3936-1","SUSE-SU-2026:3973-1","SUSE-SU-2026:4023-1","SUSE-SU-2026:4105-1","SUSE-SU-2026:4616-1","SUSE-SU-2026:4631-1","SUSE-SU-2026:4690-1","SUSE-SU-2026:4703-1","SUSE-SU-2026:4739-1","UBUNTU-CVE-2026-12548","USN-8975-1","openSUSE-SU-2026:11576-1","openSUSE-SU-2026:11596-1","openSUSE-SU-2026:22181-1"],"status":"published","title":"Libsoup: heap out-of-bounds read in libsoup due to integer truncation","description":"A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00254,"percentile":0.17152,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-07-21T18:40:52Z","modified":"2026-11-05T17:18:04Z","fixes":[{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libsoup","fixed_in":["2.72.0-10.el9_2.3.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libsoup-devel","fixed_in":["2.72.0-10.el9_2.3.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libsoup-doc","fixed_in":["2.72.0-10.el9_2.3.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libsoup","fixed_in":["2.72.0-10.el9_6.3.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libsoup-devel","fixed_in":["2.72.0-10.el9_6.3.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libsoup-doc","fixed_in":["2.72.0-10.el9_6.3.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libsoup2","fixed_in":["2.74.3-150600.4.39.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libsoup2","fixed_in":["2.74.3-150600.4.39.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libsoup2","fixed_in":["2.74.3-150600.4.39.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libsoup","fixed_in":["3.4.4-150600.3.50.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libsoup","fixed_in":["2.62.2-5.46.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libsoup2.4","fixed_in":["2.52.2-1ubuntu0.3+esm9"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libsoup2.4","fixed_in":["2.62.1-1ubuntu0.4+esm10"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libsoup2.4","fixed_in":["2.70.0-1ubuntu0.5+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libsoup2.4","fixed_in":["2.74.2-3ubuntu0.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libsoup3","fixed_in":["3.0.7-0ubuntu1+esm10"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libsoup2.4","fixed_in":["2.74.3-6ubuntu1.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libsoup3","fixed_in":["3.4.4-5ubuntu0.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"libsoup3","fixed_in":["3.6.6-1ubuntu3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libsoup3","fixed_in":["3.6.6-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"libsoup2.4","fixed_in":["2.74.3-10.1ubuntu5+esm4"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libsoup2","fixed_in":["2.74.3-22.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libsoup","fixed_in":["3.6.6-8.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.0-10.el9_2.3.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libsoup-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.0-10.el9_2.3.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libsoup-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.0-10.el9_2.3.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.0-10.el9_6.3.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libsoup-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.0-10.el9_6.3.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libsoup-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.0-10.el9_6.3.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.74.3-1","2.74.3-1+deb12u1","2.74.3-10","2.74.3-10.1","2.74.3-11","2.74.3-2","2.74.3-3","2.74.3-3.1~exp1","2.74.3-3.1~exp2","2.74.3-3.1~exp3","2.74.3-5","2.74.3-6","2.74.3-7","2.74.3-8","2.74.3-8.1","2.74.3-9"]},{"source":"osv","ecosystem":"Debian:13","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.74.3-10.1","2.74.3-11"]},{"source":"osv","ecosystem":"Debian:12","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.2-2","3.2.3-0+deb12u1","3.2.3-0+deb12u2","3.3.1-1","3.4.0-1","3.4.1-1","3.4.2-1","3.4.2-2","3.4.2-3","3.4.2-4","3.4.3-1","3.4.4-1","3.4.4-2","3.4.4-3","3.4.4-4","3.4.4-5","3.5.2-1","3.6.0-1","3.6.0-2","3.6.0-3","3.6.0-4","3.6.1-1","3.6.4-1","3.6.4-2","3.6.4-3","3.6.5-1","3.6.5-2","3.6.5-3","3.6.5-4","3.6.5-5","3.6.5-6","3.6.5-7","3.6.5-8","3.6.5-9","3.6.6-1","3.8.0-1","3.8.0-2","3.8.0-3"]},{"source":"osv","ecosystem":"Debian:13","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.5-3","3.6.5-4","3.6.5-5","3.6.5-6","3.6.5-7","3.6.5-8","3.6.5-9","3.6.6-1","3.8.0-1","3.8.0-2","3.8.0-3"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-22.oe2203sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-25.oe2403sp1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-25.oe2403sp3"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.71.0-21.oe2003sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-24.oe2403sp1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-24.oe2403sp3"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-26.oe2403sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-24.oe2403sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-159998.1.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-160000.5.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-160000.5.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.40.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.40.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.40.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.40.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.40.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.40.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.40.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.40.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.40.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.40.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.40.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150600.4.39.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150600.4.39.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150600.4.39.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-150600.3.50.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.2-5.46.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-150600.3.59.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-150600.3.59.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-150600.3.59.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.2-5.49.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.2-5.49.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150600.4.42.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150600.4.42.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150600.4.42.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.2-1ubuntu0.3+esm9"}]}],"versions":["2.50.0-2debian1","2.52.1-1","2.52.2-1","2.52.2-1ubuntu0.1","2.52.2-1ubuntu0.2","2.52.2-1ubuntu0.3","2.52.2-1ubuntu0.3+esm1","2.52.2-1ubuntu0.3+esm2","2.52.2-1ubuntu0.3+esm3","2.52.2-1ubuntu0.3+esm4","2.52.2-1ubuntu0.3+esm5","2.52.2-1ubuntu0.3+esm6","2.52.2-1ubuntu0.3+esm7","2.52.2-1ubuntu0.3+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.1-1ubuntu0.4+esm10"}]}],"versions":["2.60.1-1","2.60.2-1","2.60.2-2","2.60.3-1","2.61.90-1","2.62.0-1","2.62.1-1","2.62.1-1ubuntu0.1","2.62.1-1ubuntu0.3","2.62.1-1ubuntu0.4","2.62.1-1ubuntu0.4+esm1","2.62.1-1ubuntu0.4+esm2","2.62.1-1ubuntu0.4+esm3","2.62.1-1ubuntu0.4+esm4","2.62.1-1ubuntu0.4+esm5","2.62.1-1ubuntu0.4+esm6","2.62.1-1ubuntu0.4+esm7","2.62.1-1ubuntu0.4+esm8","2.62.1-1ubuntu0.4+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.70.0-1ubuntu0.5+esm5"}]}],"versions":["2.68.2-0ubuntu1","2.68.2-1","2.68.2-2","2.68.2-2build2","2.69.90-1","2.70.0-1","2.70.0-1ubuntu0.1","2.70.0-1ubuntu0.2","2.70.0-1ubuntu0.3","2.70.0-1ubuntu0.4","2.70.0-1ubuntu0.5","2.70.0-1ubuntu0.5+esm1","2.70.0-1ubuntu0.5+esm2","2.70.0-1ubuntu0.5+esm3","2.70.0-1ubuntu0.5+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-3ubuntu0.10"}]}],"versions":["2.72.0-3ubuntu3","2.74.1-1","2.74.2-2","2.74.2-3","2.74.2-3ubuntu0.1","2.74.2-3ubuntu0.2","2.74.2-3ubuntu0.3","2.74.2-3ubuntu0.4","2.74.2-3ubuntu0.5","2.74.2-3ubuntu0.6","2.74.2-3ubuntu0.7","2.74.2-3ubuntu0.8","2.74.2-3ubuntu0.9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-0ubuntu1+esm10"}]}],"versions":["3.0.4-2","3.0.4-3","3.0.5-1","3.0.7-0ubuntu1","3.0.7-0ubuntu1+esm1","3.0.7-0ubuntu1+esm2","3.0.7-0ubuntu1+esm3","3.0.7-0ubuntu1+esm4","3.0.7-0ubuntu1+esm5","3.0.7-0ubuntu1+esm6","3.0.7-0ubuntu1+esm7","3.0.7-0ubuntu1+esm8","3.0.7-0ubuntu1+esm9"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-6ubuntu1.10"}]}],"versions":["2.74.3-1","2.74.3-2","2.74.3-3","2.74.3-6","2.74.3-6build1","2.74.3-6ubuntu1","2.74.3-6ubuntu1.1","2.74.3-6ubuntu1.2","2.74.3-6ubuntu1.3","2.74.3-6ubuntu1.4","2.74.3-6ubuntu1.5","2.74.3-6ubuntu1.6","2.74.3-6ubuntu1.7","2.74.3-6ubuntu1.8","2.74.3-6ubuntu1.9"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-5ubuntu0.10"}]}],"versions":["3.4.2-4","3.4.4-1","3.4.4-2","3.4.4-4","3.4.4-5","3.4.4-5build1","3.4.4-5build2","3.4.4-5ubuntu0.1","3.4.4-5ubuntu0.2","3.4.4-5ubuntu0.3","3.4.4-5ubuntu0.4","3.4.4-5ubuntu0.5","3.4.4-5ubuntu0.6","3.4.4-5ubuntu0.7","3.4.4-5ubuntu0.8","3.4.4-5ubuntu0.9"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.74.3-10.1ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-1ubuntu3.1"}]}],"versions":["3.6.6-1","3.6.6-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-1ubuntu0.2"}]}],"versions":["3.6.5-4","3.6.5-5","3.6.5-6","3.6.5-7","3.6.5-9","3.6.6-1","3.6.6-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-10.1ubuntu5+esm4"}]}],"versions":["2.74.3-10.1ubuntu4","2.74.3-10.1ubuntu5","2.74.3-10.1ubuntu5+esm1","2.74.3-10.1ubuntu5+esm2","2.74.3-10.1ubuntu5+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.2-1ubuntu0.3+esm9"}]}],"versions":["2.50.0-2debian1","2.52.1-1","2.52.2-1","2.52.2-1ubuntu0.1","2.52.2-1ubuntu0.2","2.52.2-1ubuntu0.3","2.52.2-1ubuntu0.3+esm1","2.52.2-1ubuntu0.3+esm2","2.52.2-1ubuntu0.3+esm3","2.52.2-1ubuntu0.3+esm4","2.52.2-1ubuntu0.3+esm5","2.52.2-1ubuntu0.3+esm6","2.52.2-1ubuntu0.3+esm7","2.52.2-1ubuntu0.3+esm8"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.1-1ubuntu0.4+esm10"}]}],"versions":["2.60.1-1","2.60.2-1","2.60.2-2","2.60.3-1","2.61.90-1","2.62.0-1","2.62.1-1","2.62.1-1ubuntu0.1","2.62.1-1ubuntu0.3","2.62.1-1ubuntu0.4","2.62.1-1ubuntu0.4+esm1","2.62.1-1ubuntu0.4+esm2","2.62.1-1ubuntu0.4+esm3","2.62.1-1ubuntu0.4+esm4","2.62.1-1ubuntu0.4+esm5","2.62.1-1ubuntu0.4+esm6","2.62.1-1ubuntu0.4+esm7","2.62.1-1ubuntu0.4+esm8","2.62.1-1ubuntu0.4+esm9"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.70.0-1ubuntu0.5+esm5"}]}],"versions":["2.68.2-0ubuntu1","2.68.2-1","2.68.2-2","2.68.2-2build2","2.69.90-1","2.70.0-1","2.70.0-1ubuntu0.1","2.70.0-1ubuntu0.2","2.70.0-1ubuntu0.3","2.70.0-1ubuntu0.4","2.70.0-1ubuntu0.5","2.70.0-1ubuntu0.5+esm1","2.70.0-1ubuntu0.5+esm2","2.70.0-1ubuntu0.5+esm3","2.70.0-1ubuntu0.5+esm4"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-3ubuntu0.10"}]}],"versions":["2.72.0-3ubuntu3","2.74.1-1","2.74.2-2","2.74.2-3","2.74.2-3ubuntu0.1","2.74.2-3ubuntu0.2","2.74.2-3ubuntu0.3","2.74.2-3ubuntu0.4","2.74.2-3ubuntu0.5","2.74.2-3ubuntu0.6","2.74.2-3ubuntu0.7","2.74.2-3ubuntu0.8","2.74.2-3ubuntu0.9"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-0ubuntu1+esm10"}]}],"versions":["3.0.4-2","3.0.4-3","3.0.5-1","3.0.7-0ubuntu1","3.0.7-0ubuntu1+esm1","3.0.7-0ubuntu1+esm2","3.0.7-0ubuntu1+esm3","3.0.7-0ubuntu1+esm4","3.0.7-0ubuntu1+esm5","3.0.7-0ubuntu1+esm6","3.0.7-0ubuntu1+esm7","3.0.7-0ubuntu1+esm8","3.0.7-0ubuntu1+esm9"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-6ubuntu1.10"}]}],"versions":["2.74.3-1","2.74.3-2","2.74.3-3","2.74.3-6","2.74.3-6build1","2.74.3-6ubuntu1","2.74.3-6ubuntu1.1","2.74.3-6ubuntu1.2","2.74.3-6ubuntu1.3","2.74.3-6ubuntu1.4","2.74.3-6ubuntu1.5","2.74.3-6ubuntu1.6","2.74.3-6ubuntu1.7","2.74.3-6ubuntu1.8","2.74.3-6ubuntu1.9"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-5ubuntu0.10"}]}],"versions":["3.4.2-4","3.4.4-1","3.4.4-2","3.4.4-4","3.4.4-5","3.4.4-5build1","3.4.4-5build2","3.4.4-5ubuntu0.1","3.4.4-5ubuntu0.2","3.4.4-5ubuntu0.3","3.4.4-5ubuntu0.4","3.4.4-5ubuntu0.5","3.4.4-5ubuntu0.6","3.4.4-5ubuntu0.7","3.4.4-5ubuntu0.8","3.4.4-5ubuntu0.9"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-1ubuntu3.1"}]}],"versions":["3.6.6-1","3.6.6-1ubuntu3"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-1ubuntu0.2"}]}],"versions":["3.6.5-4","3.6.5-5","3.6.5-6","3.6.5-7","3.6.5-9","3.6.6-1","3.6.6-1ubuntu0.1"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-10.1ubuntu5+esm4"}]}],"versions":["2.74.3-10.1ubuntu4","2.74.3-10.1ubuntu5","2.74.3-10.1ubuntu5+esm1","2.74.3-10.1ubuntu5+esm2","2.74.3-10.1ubuntu5+esm3"],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-22.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-8.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-160000.5.1"}]}],"bundled":14}],"products":[{"vendor":"gnome","product":"libsoup"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-12548","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489996","tags":["issue-tracking","x_refsource_REDHAT","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://gitlab.gnome.org/GNOME/libsoup/-/work_items/512","tags":["exploit","Exploit","Mitigation","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12548","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wmh6-vpqv-v8q3"},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1788856994.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66337","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66338","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1788859279.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-12548","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3690","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12549","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77014","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77680","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3691","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3692","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15711","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3693","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3694","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3695","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3782","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3825","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624368-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271446","tags":["report"]},{"url":"https://bugzilla.suse.com/1271447","tags":["report"]},{"url":"https://bugzilla.suse.com/1271448","tags":["report"]},{"url":"https://bugzilla.suse.com/1271449","tags":["report"]},{"url":"https://bugzilla.suse.com/1272195","tags":["report"]},{"url":"https://bugzilla.suse.com/1272196","tags":["report"]},{"url":"https://bugzilla.suse.com/1273156","tags":["report"]},{"url":"https://bugzilla.suse.com/1283299","tags":["report"]},{"url":"https://bugzilla.suse.com/1283300","tags":["report"]},{"url":"https://bugzilla.suse.com/1283301","tags":["report"]},{"url":"https://bugzilla.suse.com/1283302","tags":["report"]},{"url":"https://bugzilla.suse.com/1283303","tags":["report"]},{"url":"https://bugzilla.suse.com/1283304","tags":["report"]},{"url":"https://bugzilla.suse.com/1283831","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-103399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66339","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624470-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263936-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1241686","tags":["report"]},{"url":"https://bugzilla.suse.com/1241688","tags":["report"]},{"url":"https://bugzilla.suse.com/1254876","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46421","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263973-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264023-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264105-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264616-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264631-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264690-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271401","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12478","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1539","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264703-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1275988","tags":["report"]},{"url":"https://bugzilla.suse.com/1276759","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77680","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264739-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-12548","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12548","tags":["report"]},{"url":"https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/524","tags":["report"]},{"url":"https://gitlab.gnome.org/GNOME/libsoup/-/commit/7334c38f1f6aa5e64207cb415cf2509838c52b37","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8975-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-12478","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-12547","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-102555","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-102556","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-102557","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-102558","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-102559","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-102560","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-103399","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-12548","title":"Libsoup: heap out-of-bounds read in libsoup due to integer truncation","description":"A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.","status":"published","published":"2026-07-21T18:40:52.174Z","modified":"2026-11-05T17:02:46.773Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-05T18:54:21.089916Z"}],"euvd":[{"id":"EUVD-2026-46363","description":"A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.","status":"published","published":"2026-07-21T18:40:52Z","modified":"2026-11-05T17:02:46Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-05T18:00:57.218327Z"}],"ghsa":[{"id":"GHSA-wmh6-vpqv-v8q3","title":"A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an...","description":"A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.","status":"published","published":"2026-07-21T21:32:39Z","modified":"2026-07-21T21:32:46Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:09:38.133598Z"}],"nvd":[{"id":"CVE-2026-12548","description":"A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.","status":"published","published":"2026-07-21T19:17:09.44Z","modified":"2026-11-05T17:18:04.087Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-05T19:55:57.517766Z"}],"osv":[{"id":"DEBIAN-CVE-2026-12548","description":"A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.","status":"published","published":"2026-07-21T19:17:09.44Z","modified":"2026-10-31T16:04:23.762425083Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:51.374409Z"},{"id":"OESA-2026-3690","title":"libsoup security update","description":"libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.\r\n\r\nSecurity Fix(es):\n\nA heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.(CVE-2026-12548)\n\nThe fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding.(CVE-2026-12549)\n\nA flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests.(CVE-2026-66338)\n\nA flaw was found in libsoup\u0026apos;s SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.(CVE-2026-77014)\n\nAn algorithmic complexity flaw exists in libsoup\u0026apos;s HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N²) work coalescing them into a single range. The vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required. The number of ranges is bounded only by the maximum request header size (~100 KiB), allowing roughly 25,000 ranges per request. This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs.(CVE-2026-77680)","status":"published","published":"2026-09-05T15:03:58Z","modified":"2026-09-05T15:16:38.127170704Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3691","title":"libsoup security update","description":"libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.\r\n\r\nSecurity Fix(es):\n\nA heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.(CVE-2026-12548)\n\nThe fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding.(CVE-2026-12549)\n\nA flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests.(CVE-2026-66338)\n\nA flaw was found in libsoup\u0026apos;s SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.(CVE-2026-77014)\n\nAn algorithmic complexity flaw exists in libsoup\u0026apos;s HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N²) work coalescing them into a single range. The vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required. The number of ranges is bounded only by the maximum request header size (~100 KiB), allowing roughly 25,000 ranges per request. This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs.(CVE-2026-77680)","status":"published","published":"2026-09-05T15:03:59Z","modified":"2026-09-05T15:16:38.128294417Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3692","title":"libsoup security update","description":"libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.\r\n\r\nSecurity Fix(es):\n\nA heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.(CVE-2026-12548)\n\nThe fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding.(CVE-2026-12549)\n\nA vulnerability was found in libsoup\u0026apos;s WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or less. A remote, unauthenticated attacker can exploit this by sending a non-compliant, oversized control frame. Because the parser handles this protocol violation improperly instead of throwing an immediate connection termination error, it triggers a internal processing crash, resulting in a remote denial of service (DoS) for applications utilizing libsoup WebSockets.(CVE-2026-15711)\n\nA flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests.(CVE-2026-66338)\n\nA flaw was found in libsoup\u0026apos;s SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.(CVE-2026-77014)\n\nAn algorithmic complexity flaw exists in libsoup\u0026apos;s HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N²) work coalescing them into a single range. The vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required. The number of ranges is bounded only by the maximum request header size (~100 KiB), allowing roughly 25,000 ranges per request. This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs.(CVE-2026-77680)","status":"published","published":"2026-09-05T15:03:59Z","modified":"2026-09-05T15:16:37.827333611Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3693","title":"libsoup security update","description":"libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.\r\n\r\nSecurity Fix(es):\n\nA heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.(CVE-2026-12548)\n\nThe fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding.(CVE-2026-12549)\n\nA flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests.(CVE-2026-66338)\n\nA flaw was found in libsoup\u0026apos;s SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.(CVE-2026-77014)\n\nAn algorithmic complexity flaw exists in libsoup\u0026apos;s HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N²) work coalescing them into a single range. The vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required. The number of ranges is bounded only by the maximum request header size (~100 KiB), allowing roughly 25,000 ranges per request. This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs.(CVE-2026-77680)","status":"published","published":"2026-09-05T15:04:00Z","modified":"2026-09-05T15:16:38.134530749Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3694","title":"libsoup3 security update","description":"Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.\r\n\r\nSecurity Fix(es):\n\nA heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.(CVE-2026-12548)\n\nThe fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding.(CVE-2026-12549)\n\nA vulnerability was found in libsoup\u0026apos;s WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or less. A remote, unauthenticated attacker can exploit this by sending a non-compliant, oversized control frame. Because the parser handles this protocol violation improperly instead of throwing an immediate connection termination error, it triggers a internal processing crash, resulting in a remote denial of service (DoS) for applications utilizing libsoup WebSockets.(CVE-2026-15711)\n\nA flaw was found in libsoup\u0026apos;s SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.(CVE-2026-77014)\n\nAn algorithmic complexity flaw exists in libsoup\u0026apos;s HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N²) work coalescing them into a single range. The vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required. The number of ranges is bounded only by the maximum request header size (~100 KiB), allowing roughly 25,000 ranges per request. This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs.(CVE-2026-77680)","status":"published","published":"2026-09-05T15:04:01Z","modified":"2026-09-05T15:16:37.83041532Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3695","title":"libsoup3 security update","description":"Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.\r\n\r\nSecurity Fix(es):\n\nA heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.(CVE-2026-12548)\n\nThe fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding.(CVE-2026-12549)\n\nA vulnerability was found in libsoup\u0026apos;s WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or less. A remote, unauthenticated attacker can exploit this by sending a non-compliant, oversized control frame. Because the parser handles this protocol violation improperly instead of throwing an immediate connection termination error, it triggers a internal processing crash, resulting in a remote denial of service (DoS) for applications utilizing libsoup WebSockets.(CVE-2026-15711)\n\nA flaw was found in libsoup\u0026apos;s SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.(CVE-2026-77014)\n\nAn algorithmic complexity flaw exists in libsoup\u0026apos;s HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N²) work coalescing them into a single range. The vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required. The number of ranges is bounded only by the maximum request header size (~100 KiB), allowing roughly 25,000 ranges per request. This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs.(CVE-2026-77680)","status":"published","published":"2026-09-05T15:04:01Z","modified":"2026-09-05T15:16:38.128544825Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3782","title":"libsoup security update","description":"libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.\r\n\r\nSecurity Fix(es):\n\nA heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.(CVE-2026-12548)\n\nThe fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding.(CVE-2026-12549)\n\nA vulnerability was found in libsoup\u0026apos;s WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or less. A remote, unauthenticated attacker can exploit this by sending a non-compliant, oversized control frame. Because the parser handles this protocol violation improperly instead of throwing an immediate connection termination error, it triggers a internal processing crash, resulting in a remote denial of service (DoS) for applications utilizing libsoup WebSockets.(CVE-2026-15711)\n\nA flaw was found in libsoup\u0026apos;s SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.(CVE-2026-77014)\n\nAn algorithmic complexity flaw exists in libsoup\u0026apos;s HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N²) work coalescing them into a single range. The vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required. The number of ranges is bounded only by the maximum request header size (~100 KiB), allowing roughly 25,000 ranges per request. This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs.(CVE-2026-77680)","status":"published","published":"2026-09-14T16:34:18Z","modified":"2026-09-13T16:45:42.470415774Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3825","title":"libsoup3 security update","description":"Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.\r\n\r\nSecurity Fix(es):\n\nA heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.(CVE-2026-12548)\n\nThe fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding.(CVE-2026-12549)\n\nA vulnerability was found in libsoup\u0026apos;s WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or less. A remote, unauthenticated attacker can exploit this by sending a non-compliant, oversized control frame. Because the parser handles this protocol violation improperly instead of throwing an immediate connection termination error, it triggers a internal processing crash, resulting in a remote denial of service (DoS) for applications utilizing libsoup WebSockets.(CVE-2026-15711)\n\nA flaw was found in libsoup\u0026apos;s SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.(CVE-2026-77014)\n\nAn algorithmic complexity flaw exists in libsoup\u0026apos;s HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N²) work coalescing them into a single range. The vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required. The number of ranges is bounded only by the maximum request header size (~100 KiB), allowing roughly 25,000 ranges per request. This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs.(CVE-2026-77680)","status":"published","published":"2026-09-14T16:34:44Z","modified":"2026-09-13T16:45:45.766120702Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"UBUNTU-CVE-2026-12548","description":"A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.","status":"published","published":"2026-07-21T19:17:00Z","modified":"2026-11-04T03:30:03.889375233Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-04T03:56:45.249606Z"},{"id":"CLSA-2026-1788856994","title":"libsoup: Fix of 3 CVEs","description":"- CVE-2026-12548: cap the header block passed to soup_headers_parse() at 256K,\n  preventing an int truncation of the length parameter and the resulting heap\n  over-read when parsing multipart messages","status":"published","published":"2026-09-10T08:13:11Z","modified":"2026-10-26T09:30:46.203398055Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1788859279","title":"libsoup: Fix of CVE-2026-12548","description":"- CVE-2026-12548: cap the header block passed to soup_headers_parse() at 256K,\n  preventing an int truncation of the length parameter and the resulting heap\n  over-read when parsing multipart messages","status":"published","published":"2026-09-08T09:21:28Z","modified":"2026-10-26T09:31:32.354342833Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"openSUSE-SU-2026:11576-1","title":"libsoup-2_4-1-2.74.3-22.1 on GA media","description":"These are all security issues fixed in the libsoup-2_4-1-2.74.3-22.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-22T00:00:00Z","modified":"2026-08-23T11:15:04.021131731Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11596-1","title":"libsoup-3_0-0-3.6.6-8.1 on GA media","description":"These are all security issues fixed in the libsoup-3_0-0-3.6.6-8.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-25T00:00:00Z","modified":"2026-08-26T10:15:04.36863086Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:22181-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2026-12547: Header \"Proxy-Authorization\" leads to credentials being send to different proxy after proxy switch\n  (bsc#1272195).\n- CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation (bsc#1272196).\n- CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol\n  violation (bsc#1271446).\n- CVE-2026-15712: SoupClientMessageIOHTTP2: HTTP/2 GOAWAY frame parsing heap buffer over-read via invalid NUL-\n  termination assumption (bsc#1271447).\n- CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak\n  (bsc#1271448).\n- CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers\n  via an oversized multipart boundary string (bsc#1271449).\n- CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT tunnels\n  (bsc#1273156).\n- CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding (bsc#1283299).\n- CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).\n- CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).\n- CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).\n- CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).\n- CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).\n- CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling\n  (bsc#1283831).\n","status":"published","published":"2026-10-29T10:24:12Z","modified":"2026-10-31T18:00:09.296668455Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:24368-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2026-12547: Header \"Proxy-Authorization\" leads to credentials being send to different proxy after proxy switch\n  (bsc#1272195).\n- CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation (bsc#1272196).\n- CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol\n  violation (bsc#1271446).\n- CVE-2026-15712: SoupClientMessageIOHTTP2: HTTP/2 GOAWAY frame parsing heap buffer over-read via invalid NUL-\n  termination assumption (bsc#1271447).\n- CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak\n  (bsc#1271448).\n- CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers\n  via an oversized multipart boundary string (bsc#1271449).\n- CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT tunnels\n  (bsc#1273156).\n- CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding (bsc#1283299).\n- CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).\n- CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).\n- CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).\n- CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).\n- CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).\n- CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling\n  (bsc#1283831).\n","status":"published","published":"2026-10-21T08:56:44Z","modified":"2026-10-27T17:23:18.80097485Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24470-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2026-12547: Header \"Proxy-Authorization\" leads to credentials being send to different proxy after proxy switch\n  (bsc#1272195).\n- CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation (bsc#1272196).\n- CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol\n  violation (bsc#1271446).\n- CVE-2026-15712: SoupClientMessageIOHTTP2: HTTP/2 GOAWAY frame parsing heap buffer over-read via invalid NUL-\n  termination assumption (bsc#1271447).\n- CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak\n  (bsc#1271448).\n- CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers\n  via an oversized multipart boundary string (bsc#1271449).\n- CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT tunnels\n  (bsc#1273156).\n- CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding (bsc#1283299).\n- CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).\n- CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).\n- CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).\n- CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).\n- CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).\n- CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling\n  (bsc#1283831).\n","status":"published","published":"2026-10-29T10:24:20Z","modified":"2026-11-04T17:23:18.62343932Z","updated_at":"2026-11-04T17:43:22.558805Z"},{"id":"SUSE-SU-2026:3936-1","title":"Security update for libsoup2","description":"This update for libsoup2 fixes the following issues:\n\n- CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation (bsc#1272196).\n\nChanges for libsoup2:\n\n- tld-test: update after changes in the public\n suffix list: '*.bd' is no longer in the public suffix list so let's use '.jm'\n instead.\n- Increase test timeout for all arches except x86_64 and run tests\n again should they fail the first time, the testsuite is flaky.\n- Increase test timeout on s390x. The http2-body-stream test can be\n slow and sometimes times out in our builds.\n- fix an intermittent test failure (glgo#GNOME/libsoup#399).\n- Fix build with libxml2-2.12.0 and clang-17.\n- Add upstream bug fixes:\n + lib: Add g_task_set_source_tag() everywhere\n + lib: Add names to various GSources\n- Drop no longer valid translation-update-upstream BuildRequires\n and macro.\n- Use ldconfig_scriptlets macro for post(un) handling.\n- Update to version 2.74.3:\n + Add missing g-i annotations to `soup_address_get_sockaddr()`\n and `soup_socket_read_until()`.\n + Add missing `extern` when building on Windows.\n + Update libxml2 fallback for meson wrap.\n + Improvements when using libsoup with meson wraps.\n","status":"published","published":"2026-09-03T07:27:25Z","modified":"2026-09-10T18:23:18.058576709Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3973-1","title":"Security update for libsoup2","description":"This update for libsoup2 fixes the following issues:\n\n- CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation (bsc#1272196).\n\nChanges for libsoup2:\n\n- update after changes in the public suffix list: '*.bd' is no longer in the public suffix list so let's \n  use '.jm' instead.\n","status":"published","published":"2026-09-04T08:21:06Z","modified":"2026-09-13T18:23:13.35721042Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4023-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issue:\n\n- CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation (bsc#1272196).\n","status":"published","published":"2026-09-07T07:42:55Z","modified":"2026-09-13T18:23:16.108488498Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4105-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issue:\n\n- CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation (bsc#1272196).\n","status":"published","published":"2026-09-09T13:23:10Z","modified":"2026-09-14T18:23:14.067589992Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4616-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak\n  (bsc#1271448).\n- CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding (bsc#1283299).\n- CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).\n- CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).\n- CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).\n- CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).\n- CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).\n","status":"published","published":"2026-10-12T07:21:28Z","modified":"2026-10-13T10:30:04.879685509Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4631-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak\n  (bsc#1271448).\n- CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding (bsc#1283299).\n- CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).\n- CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).\n- CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).\n- CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).\n- CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).\n","status":"published","published":"2026-10-12T15:25:46Z","modified":"2026-10-13T10:30:06.857496744Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4690-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2026-12478: websocket: Fix out-of-bounds read when reading unmasked frame (bsc#1271401).\n- CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch\n  (bsc#1272195).\n- CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol\n  violation (bsc#1271446).\n- CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak\n  (bsc#1271448).\n- CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers via\n  an oversized multipart boundary string (bsc#1271449).\n- CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT tunnels\n  (bsc#1273156).\n- CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).\n- CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).\n- CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).\n- CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).\n- CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling\n  (bsc#1283831).\n","status":"published","published":"2026-10-16T08:41:55Z","modified":"2026-10-17T10:00:05.096101754Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4703-1","title":"Security update for libsoup2","description":"This update for libsoup2 fixes the following issues:\n\n- CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch\n  (bsc#1272195).\n- CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol\n  violation (bsc#1271446).\n- CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak\n  (bsc#1271448).\n- CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers via\n  an oversized multipart boundary string (bsc#1271449).\n- CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT tunnels\n  (bsc#1273156).\n- CVE-2026-77014: Integer truncation in sort_ranges() comparator causes silent omission of HTTP Range responses\n  (bsc#1275988).\n- CVE-2026-77680: quadratic CPU denial of service in HTTP Range coalescing after the CVE-2025-32907 fix (bsc#1276759).\n- CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).\n- CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).\n- CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).\n- CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).\n- CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).\n- CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling\n  (bsc#1283831).\n","status":"published","published":"2026-10-16T13:29:46Z","modified":"2026-10-17T10:00:04.12517112Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4739-1","title":"Security update for libsoup2","description":"This update for libsoup2 fixes the following issues:\n\n- CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch\n  (bsc#1272195).\n- CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol\n  violation (bsc#1271446).\n- CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak\n  (bsc#1271448).\n- CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers via\n  an oversized multipart boundary string (bsc#1271449).\n- CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT tunnels\n  (bsc#1273156).\n- CVE-2026-77014: Integer truncation in sort_ranges() comparator causes silent omission of HTTP Range responses\n  (bsc#1275988).\n- CVE-2026-77680: quadratic CPU denial of service in HTTP Range coalescing after the CVE-2025-32907 fix (bsc#1276759).\n- CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).\n- CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).\n- CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).\n- CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).\n- CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).\n- CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling\n  (bsc#1283831).\n","status":"published","published":"2026-10-19T12:59:37Z","modified":"2026-10-20T10:45:04.185304919Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"USN-8975-1","title":"libsoup2.4, libsoup3 vulnerabilities","description":"It was discovered that libsoup incorrectly handled certain WebSocket\nframes. A remote attacker could possibly use this issue to cause an\napplication to crash or expose sensitive information. This issue only\naffected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu\n26.10. (CVE-2026-12478)\n\nIt was discovered that libsoup incorrectly handled certain data URIs. A\nremote attacker could possibly use this issue to cause an application to\ncrash or expose sensitive information. This issue only affected Ubuntu\n22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10.\n(CVE-2026-102555)\n\nIt was discovered that libsoup incorrectly handled certain WebSocket\nmessages. A remote attacker could possibly use this issue to cause an\napplication to crash. This issue only affected Ubuntu 18.04 LTS, Ubuntu\n20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and\nUbuntu 26.10. (CVE-2026-102556)\n\nIt was discovered that libsoup incorrectly handled fragmented WebSocket\nmessages. A remote attacker could possibly use this issue to cause an\napplication to crash. (CVE-2026-102557)\n\nIt was discovered that libsoup incorrectly handled certain WebSocket\nframes. A remote attacker could possibly use this issue to cause an\napplication to crash. This issue only affected Ubuntu 18.04 LTS, Ubuntu\n20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and\nUbuntu 26.10. (CVE-2026-102558)\n\nIt was discovered that libsoup incorrectly handled large WebSocket\nmessages. An attacker could possibly use this issue to cause an\napplication to crash. (CVE-2026-102559)\n\nIt was discovered that libsoup incorrectly handled compressed WebSocket\nmessages. An attacker could possibly use this issue to cause an\napplication to crash. This issue only affected Ubuntu 20.04 LTS, Ubuntu\n22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10.\n(CVE-2026-102560)\n\nIt was discovered that libsoup did not properly handle certain HTTP\nrequests. A remote attacker could possibly use this issue to inject\narbitrary HTTP requests. (CVE-2026-103399)\n\nIt was discovered that libsoup incorrectly handled proxy credentials. A\nremote attacker could possibly use this issue to obtain sensitive\ninformation. (CVE-2026-12547)\n\nIt was discovered that libsoup incorrectly handled multipart messages. A\nremote attacker could possibly use this issue to cause an application to\ncrash or obtain sensitive information. (CVE-2026-12548)","status":"published","published":"2026-11-03T16:06:30Z","modified":"2026-11-04T03:43:15.637548273Z","updated_at":"2026-11-04T03:56:18.279609Z"}]}}