{"id":"CVE-2026-2436","aliases":["AZL-81519","DEBIAN-CVE-2026-2436","EUVD-2026-16342","GHSA-wpfw-5xvc-wq9w","OESA-2026-2666","OESA-2026-2667","ROOT-OS-DEBIAN-12-CVE-2026-2436","ROOT-OS-DEBIAN-13-CVE-2026-2436","UBUNTU-CVE-2026-2436"],"status":"published","title":"Libsoup: libsoup: denial of service via use-after-free in soupserver during tls handshake","description":"A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00465,"percentile":0.40775,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-825"],"published":"2026-03-26T19:31:34Z","modified":"2026-11-10T02:50:24Z","fixes":[{"ecosystem":"Azure Linux:3","package":"libsoup","fixed_in":["3.4.4-15"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"libsoup2.4","fixed_in":["2.74.3-1+deb12u1.aikido.3","2.74.3-1+deb12u1.aikido.4","2.74.3-1+deb12u1.aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-libsoup2.4","fixed_in":["2.74.3-1+deb12u1.aikido.3","2.74.3-1+deb12u1.aikido.4","2.74.3-1+deb12u1.aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"libsoup3","fixed_in":["3.6.5-3.aikido.4","3.6.5-3.aikido.3","3.6.5-3.root.io.1","3.6.5-3.root.io.2","3.6.5-3.aikido.5","3.6.5-3.aikido.6","3.6.5-3.aikido.7","3.6.5-3.aikido.8","3.6.5-3.aikido.9"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-libsoup3","fixed_in":["3.6.5-3.aikido.4","3.6.5-3.aikido.3","3.6.5-3.root.io.1","3.6.5-3.root.io.2","3.6.5-3.aikido.5","3.6.5-3.aikido.6","3.6.5-3.aikido.7","3.6.5-3.aikido.8","3.6.5-3.aikido.9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-15"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.74.3-1","2.74.3-1+deb12u1","2.74.3-10","2.74.3-10.1","2.74.3-11","2.74.3-2","2.74.3-3","2.74.3-3.1~exp1","2.74.3-3.1~exp2","2.74.3-3.1~exp3","2.74.3-5","2.74.3-6","2.74.3-7","2.74.3-8","2.74.3-8.1","2.74.3-9"]},{"source":"osv","ecosystem":"Debian:13","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.74.3-10.1","2.74.3-11"]},{"source":"osv","ecosystem":"Debian:12","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.2-2","3.2.3-0+deb12u1","3.2.3-0+deb12u2","3.3.1-1","3.4.0-1","3.4.1-1","3.4.2-1","3.4.2-2","3.4.2-3","3.4.2-4","3.4.3-1","3.4.4-1","3.4.4-2","3.4.4-3","3.4.4-4","3.4.4-5","3.5.2-1","3.6.0-1","3.6.0-2","3.6.0-3","3.6.0-4","3.6.1-1","3.6.4-1","3.6.4-2","3.6.4-3","3.6.5-1","3.6.5-2","3.6.5-3","3.6.5-4","3.6.5-5","3.6.5-6","3.6.5-7","3.6.5-8","3.6.5-9","3.6.6-1","3.8.0-1","3.8.0-2","3.8.0-3"]},{"source":"osv","ecosystem":"Debian:13","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.5-3","3.6.5-4","3.6.5-5","3.6.5-6","3.6.5-7","3.6.5-8","3.6.5-9","3.6.6-1","3.8.0-1","3.8.0-2","3.8.0-3"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-19.oe2403sp1"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-19.oe2403sp3"}]}],"bundled":4},{"source":"osv","ecosystem":"Root:Debian:12","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-1+deb12u1.aikido.3"},{"fixed":"2.74.3-1+deb12u1.aikido.4"},{"fixed":"2.74.3-1+deb12u1.aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-1+deb12u1.aikido.3"},{"fixed":"2.74.3-1+deb12u1.aikido.4"},{"fixed":"2.74.3-1+deb12u1.aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.5-3.aikido.4"},{"fixed":"3.6.5-3.aikido.3"},{"fixed":"3.6.5-3.root.io.1"},{"fixed":"3.6.5-3.root.io.2"},{"fixed":"3.6.5-3.aikido.5"},{"fixed":"3.6.5-3.aikido.6"},{"fixed":"3.6.5-3.aikido.7"},{"fixed":"3.6.5-3.aikido.8"},{"fixed":"3.6.5-3.aikido.9"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.5-3.aikido.4"},{"fixed":"3.6.5-3.aikido.3"},{"fixed":"3.6.5-3.root.io.1"},{"fixed":"3.6.5-3.root.io.2"},{"fixed":"3.6.5-3.aikido.5"},{"fixed":"3.6.5-3.aikido.6"},{"fixed":"3.6.5-3.aikido.7"},{"fixed":"3.6.5-3.aikido.8"},{"fixed":"3.6.5-3.aikido.9"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.4-2","3.0.4-3","3.0.5-1","3.0.7-0ubuntu1","3.0.7-0ubuntu1+esm1","3.0.7-0ubuntu1+esm2","3.0.7-0ubuntu1+esm3","3.0.7-0ubuntu1+esm4","3.0.7-0ubuntu1+esm5","3.0.7-0ubuntu1+esm6","3.0.7-0ubuntu1+esm7","3.0.7-0ubuntu1+esm8","3.0.7-0ubuntu1+esm9","3.0.7-0ubuntu1+esm10"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.2-4","3.4.4-1","3.4.4-2","3.4.4-4","3.4.4-5","3.4.4-5build1","3.4.4-5build2","3.4.4-5ubuntu0.1","3.4.4-5ubuntu0.2","3.4.4-5ubuntu0.3","3.4.4-5ubuntu0.4","3.4.4-5ubuntu0.5","3.4.4-5ubuntu0.6","3.4.4-5ubuntu0.7","3.4.4-5ubuntu0.8","3.4.4-5ubuntu0.9","3.4.4-5ubuntu0.10","3.4.4-5ubuntu0.11"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.5-1","3.6.5-1ubuntu1","3.6.5-3","3.6.5-4","3.6.5-4ubuntu0.1","3.6.5-4ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.6-1","3.6.6-1ubuntu3","3.6.6-1ubuntu3.1","3.6.6-1ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.5-4","3.6.5-5","3.6.5-6","3.6.5-7","3.6.5-9","3.6.6-1","3.6.6-1ubuntu0.1","3.6.6-1ubuntu0.2","3.6.6-1ubuntu0.3"]}],"products":[{"vendor":"gnome","product":"libsoup"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-2436","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442909","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Third Party Advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libsoup/-/issues/501","tags":["Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2436","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-wpfw-5xvc-wq9w"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-2436","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2666","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32049","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32050","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32051","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32907","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1760","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2708","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2667","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-2436","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2436","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-2436","title":"Libsoup: libsoup: denial of service via use-after-free in soupserver during tls handshake","description":"A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service.","status":"published","published":"2026-03-26T19:31:34.27Z","modified":"2026-11-05T19:32:14.9Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-825"],"updated_at":"2026-11-05T20:54:59.423743Z"}],"euvd":[{"id":"EUVD-2026-16342","description":"A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service.","status":"published","published":"2026-03-26T19:31:34Z","modified":"2026-11-05T19:32:14Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-05T21:01:59.785126Z"}],"ghsa":[{"id":"GHSA-wpfw-5xvc-wq9w","title":"A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free...","description":"A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service.","status":"published","published":"2026-03-26T21:31:26Z","modified":"2026-03-26T21:31:34Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-825"],"updated_at":"2026-11-02T15:06:53.526079Z"}],"nvd":[{"id":"CVE-2026-2436","description":"A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service.","status":"published","published":"2026-03-26T20:16:11.72Z","modified":"2026-11-05T20:17:57.737Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-825"],"updated_at":"2026-11-05T21:56:41.057422Z"}],"osv":[{"id":"DEBIAN-CVE-2026-2436","description":"A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service.","status":"published","published":"2026-03-26T20:16:11.72Z","modified":"2026-10-31T16:00:13.266101451Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"OESA-2026-2666","title":"libsoup3 security update","description":"Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).(CVE-2025-32049)\n\nA flaw was found in libsoup. The libsoup append_param_quoted() function may contain an overflow bug resulting in a buffer under-read.(CVE-2025-32050)\n\nA flaw was found in libsoup. The libsoup soup_uri_decode_data_uri() function may crash when processing malformed data URI. This flaw allows an attacker to cause a denial of service (DoS).(CVE-2025-32051)\n\nA flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of service.(CVE-2025-32907)\n\nA flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine Transfer-Encoding: chunked and Connection: keep-alive headers. A remote, unauthenticated client can exploit this by sending specially crafted requests, causing SoupServer to fail to close the connection as required by RFC 9112. This allows the attacker to smuggle additional requests over the persistent connection, leading to unintended request processing and potential denial-of-service (DoS) conditions.(CVE-2026-1760)\n\nA flaw was found in libsoup\u0026apos;s SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service.(CVE-2026-2436)\n\nA request smuggling vulnerability exists in libsoup\u0026apos;s HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.(CVE-2026-2708)","status":"published","published":"2026-06-12T11:11:36Z","modified":"2026-08-18T01:20:04.989710599Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2667","title":"libsoup3 security update","description":"Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).(CVE-2025-32049)\n\nA flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of service.(CVE-2025-32907)\n\nA flaw was found in libsoup\u0026apos;s SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service.(CVE-2026-2436)\n\nA request smuggling vulnerability exists in libsoup\u0026apos;s HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.(CVE-2026-2708)","status":"published","published":"2026-06-12T11:11:36Z","modified":"2026-08-18T01:20:05.092294181Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-2436","title":"CVE-2026-2436 in libsoup2.4 - Patched by Root","description":"Root has patched CVE-2026-2436 in the libsoup2.4 package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-09-11T06:48:05Z","modified":"2026-09-11T07:15:08.503066788Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:31.773105Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-2436","title":"CVE-2026-2436 in libsoup3 - Patched by Root","description":"Root has patched CVE-2026-2436 in the libsoup3 package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-11-04T14:29:10Z","modified":"2026-11-04T15:15:06.268416183Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-04T15:39:09.547857Z"},{"id":"UBUNTU-CVE-2026-2436","description":"A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service.","status":"published","published":"2026-03-26T20:16:00Z","modified":"2026-11-10T02:50:24.204738992Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-10T03:19:05.90942Z"},{"id":"AZL-81519","title":"CVE-2026-2436 affecting package libsoup for versions less than 3.4.4-15","description":"A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service.","status":"published","published":"2026-03-26T20:16:11Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.800038Z"}]}}