{"id":"CVE-2026-66337","aliases":["AZL-94101","DEBIAN-CVE-2026-66337","EUVD-2026-48753","GHSA-ww4c-c3rv-f96h","OESA-2026-4389","OESA-2026-4390","OESA-2026-4391","OESA-2026-4441","UBUNTU-CVE-2026-66337","openSUSE-SU-2026:12365-1"],"status":"published","title":"Libsoup: libsoup: heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()","description":"A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00246,"percentile":0.15943,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-125"],"published":"2026-07-24T23:01:20Z","modified":"2026-11-10T02:51:07Z","affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.4.4-18"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.74.3-1","2.74.3-1+deb12u1","2.74.3-10","2.74.3-10.1","2.74.3-11","2.74.3-2","2.74.3-3","2.74.3-3.1~exp1","2.74.3-3.1~exp2","2.74.3-3.1~exp3","2.74.3-5","2.74.3-6","2.74.3-7","2.74.3-8","2.74.3-8.1","2.74.3-9"]},{"source":"osv","ecosystem":"Debian:13","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.74.3-10.1","2.74.3-11"]},{"source":"osv","ecosystem":"Debian:12","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.2-2","3.2.3-0+deb12u1","3.2.3-0+deb12u2","3.3.1-1","3.4.0-1","3.4.1-1","3.4.2-1","3.4.2-2","3.4.2-3","3.4.2-4","3.4.3-1","3.4.4-1","3.4.4-2","3.4.4-3","3.4.4-4","3.4.4-5","3.5.2-1","3.6.0-1","3.6.0-2","3.6.0-3","3.6.0-4","3.6.1-1","3.6.4-1","3.6.4-2","3.6.4-3","3.6.5-1","3.6.5-2","3.6.5-3","3.6.5-4","3.6.5-5","3.6.5-6","3.6.5-7","3.6.5-8","3.6.5-9","3.6.6-1","3.8.0-1","3.8.0-2","3.8.0-3"]},{"source":"osv","ecosystem":"Debian:13","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.5-3","3.6.5-4","3.6.5-5","3.6.5-6","3.6.5-7","3.6.5-8","3.6.5-9","3.6.6-1","3.8.0-1","3.8.0-2","3.8.0-3"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-29.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-29.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-29.oe2403sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-27.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.50.0-2debian1","2.52.1-1","2.52.2-1","2.52.2-1ubuntu0.1","2.52.2-1ubuntu0.2","2.52.2-1ubuntu0.3","2.52.2-1ubuntu0.3+esm1","2.52.2-1ubuntu0.3+esm2","2.52.2-1ubuntu0.3+esm3","2.52.2-1ubuntu0.3+esm4","2.52.2-1ubuntu0.3+esm5","2.52.2-1ubuntu0.3+esm6","2.52.2-1ubuntu0.3+esm7","2.52.2-1ubuntu0.3+esm8","2.52.2-1ubuntu0.3+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.60.1-1","2.60.2-1","2.60.2-2","2.60.3-1","2.61.90-1","2.62.0-1","2.62.1-1","2.62.1-1ubuntu0.1","2.62.1-1ubuntu0.3","2.62.1-1ubuntu0.4","2.62.1-1ubuntu0.4+esm1","2.62.1-1ubuntu0.4+esm2","2.62.1-1ubuntu0.4+esm3","2.62.1-1ubuntu0.4+esm4","2.62.1-1ubuntu0.4+esm5","2.62.1-1ubuntu0.4+esm6","2.62.1-1ubuntu0.4+esm7","2.62.1-1ubuntu0.4+esm8","2.62.1-1ubuntu0.4+esm9","2.62.1-1ubuntu0.4+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.68.2-0ubuntu1","2.68.2-1","2.68.2-2","2.68.2-2build2","2.69.90-1","2.70.0-1","2.70.0-1ubuntu0.1","2.70.0-1ubuntu0.2","2.70.0-1ubuntu0.3","2.70.0-1ubuntu0.4","2.70.0-1ubuntu0.5","2.70.0-1ubuntu0.5+esm1","2.70.0-1ubuntu0.5+esm2","2.70.0-1ubuntu0.5+esm3","2.70.0-1ubuntu0.5+esm4","2.70.0-1ubuntu0.5+esm5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.72.0-3ubuntu3","2.74.1-1","2.74.2-2","2.74.2-3","2.74.2-3ubuntu0.1","2.74.2-3ubuntu0.2","2.74.2-3ubuntu0.3","2.74.2-3ubuntu0.4","2.74.2-3ubuntu0.5","2.74.2-3ubuntu0.6","2.74.2-3ubuntu0.7","2.74.2-3ubuntu0.8","2.74.2-3ubuntu0.9","2.74.2-3ubuntu0.10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.4-2","3.0.4-3","3.0.5-1","3.0.7-0ubuntu1","3.0.7-0ubuntu1+esm1","3.0.7-0ubuntu1+esm2","3.0.7-0ubuntu1+esm3","3.0.7-0ubuntu1+esm4","3.0.7-0ubuntu1+esm5","3.0.7-0ubuntu1+esm6","3.0.7-0ubuntu1+esm7","3.0.7-0ubuntu1+esm8","3.0.7-0ubuntu1+esm9","3.0.7-0ubuntu1+esm10"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.74.3-1","2.74.3-2","2.74.3-3","2.74.3-6","2.74.3-6build1","2.74.3-6ubuntu1","2.74.3-6ubuntu1.1","2.74.3-6ubuntu1.2","2.74.3-6ubuntu1.3","2.74.3-6ubuntu1.4","2.74.3-6ubuntu1.5","2.74.3-6ubuntu1.6","2.74.3-6ubuntu1.7","2.74.3-6ubuntu1.8","2.74.3-6ubuntu1.9","2.74.3-6ubuntu1.10"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.2-4","3.4.4-1","3.4.4-2","3.4.4-4","3.4.4-5","3.4.4-5build1","3.4.4-5build2","3.4.4-5ubuntu0.1","3.4.4-5ubuntu0.2","3.4.4-5ubuntu0.3","3.4.4-5ubuntu0.4","3.4.4-5ubuntu0.5","3.4.4-5ubuntu0.6","3.4.4-5ubuntu0.7","3.4.4-5ubuntu0.8","3.4.4-5ubuntu0.9","3.4.4-5ubuntu0.10","3.4.4-5ubuntu0.11"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.74.3-10.1ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.6-1","3.6.6-1ubuntu3","3.6.6-1ubuntu3.1","3.6.6-1ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.5-4","3.6.5-5","3.6.5-6","3.6.5-7","3.6.5-9","3.6.6-1","3.6.6-1ubuntu0.1","3.6.6-1ubuntu0.2","3.6.6-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.74.3-10.1ubuntu4","2.74.3-10.1ubuntu5","2.74.3-10.1ubuntu5+esm1","2.74.3-10.1ubuntu5+esm2","2.74.3-10.1ubuntu5+esm3","2.74.3-10.1ubuntu5+esm4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.1-1.1"}]}],"bundled":10}],"products":[{"vendor":"gnome","product":"libsoup"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-66337","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506949","tags":["issue-tracking","x_refsource_REDHAT","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66337","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-ww4c-c3rv-f96h"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-66337","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4389","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12547","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4390","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4391","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66338","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4441","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102558","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102560","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-66337","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-66337","tags":["report"]},{"url":"https://gitlab.gnome.org/GNOME/libsoup/-/work_items/532","tags":["report"]},{"url":"https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/557","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66339","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-66337","title":"Libsoup: libsoup: heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()","description":"A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory.","status":"published","published":"2026-07-24T23:01:20.983Z","modified":"2026-11-05T22:13:09.637Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-05T23:55:29.66083Z"}],"euvd":[{"id":"EUVD-2026-48753","description":"A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory.","status":"published","published":"2026-07-24T23:01:20Z","modified":"2026-11-05T22:13:09Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-05T23:02:19.769742Z"}],"ghsa":[{"id":"GHSA-ww4c-c3rv-f96h","title":"A flaw was found in libsoup. An unsigned integer underflow in the...","description":"A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory.","status":"published","published":"2026-07-25T00:31:48Z","modified":"2026-07-25T00:31:54Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:09:49.369416Z"}],"nvd":[{"id":"CVE-2026-66337","description":"A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory.","status":"published","published":"2026-07-24T23:16:51.76Z","modified":"2026-11-05T23:16:55.983Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-06T01:57:39.389848Z"}],"osv":[{"id":"DEBIAN-CVE-2026-66337","description":"A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory.","status":"published","published":"2026-07-24T23:16:51.76Z","modified":"2026-10-31T16:01:41.753642692Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:58.699079Z"},{"id":"OESA-2026-4389","title":"libsoup security update","description":"libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.\r\n\r\nSecurity Fix(es):\n\nSoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.(CVE-2026-12547)\n\nA flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory.(CVE-2026-66337)","status":"published","published":"2026-10-16T12:00:05Z","modified":"2026-10-16T12:15:14.600631057Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4390","title":"libsoup security update","description":"libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.\r\n\r\nSecurity Fix(es):\n\nSoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.(CVE-2026-12547)\n\nA flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory.(CVE-2026-66337)","status":"published","published":"2026-10-16T12:00:05Z","modified":"2026-10-16T12:15:14.491496638Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4391","title":"libsoup security update","description":"libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.\r\n\r\nSecurity Fix(es):\n\nSoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.(CVE-2026-12547)\n\nA flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory.(CVE-2026-66337)\n\nA flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests.(CVE-2026-66338)","status":"published","published":"2026-10-16T12:00:06Z","modified":"2026-10-16T12:15:13.689534088Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4441","title":"libsoup security update","description":"libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data.(CVE-2026-102558)\n\nA flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.(CVE-2026-102560)\n\nA flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory.(CVE-2026-66337)","status":"published","published":"2026-10-22T14:35:10Z","modified":"2026-10-22T14:45:06.682913457Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"UBUNTU-CVE-2026-66337","description":"A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory.","status":"published","published":"2026-07-24T23:16:00Z","modified":"2026-11-10T02:51:07.69354487Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-10T03:19:55.713577Z"},{"id":"AZL-94101","title":"CVE-2026-66337 affecting package libsoup 3.4.4-18","description":"A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory.","status":"published","published":"2026-07-24T23:16:51Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.880689Z"},{"id":"openSUSE-SU-2026:12365-1","title":"libsoup-3_0-0-3.8.1-1.1 on GA media","description":"These are all security issues fixed in the libsoup-3_0-0-3.8.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-30T00:00:00Z","modified":"2026-10-31T18:00:03.938535156Z","updated_at":"2026-11-02T16:58:41.463445Z"}]}}