Libsoup: Four DoS and Out-of-Bounds Read Vulnerabilities Disclosed Together
Four vulnerabilities affecting Libsoup's HTTP client library were disclosed together on July 14, 2026, including denial-of-service and out-of-bounds read flaws.
Key findings
- Four Libsoup vulnerabilities disclosed on July 14, 2026, including DoS and out-of-bounds read flaws.
- Two moderate-severity WebSocket vulnerabilities (CVE-2026-15711, CVE-2026-15709) involve oversized frames and decompression issues.
- An out-of-bounds read (CVE-2026-15714) affects multipart stream header parsing.
- A low-severity DoS (CVE-2026-15713) impacts HTTP/2 frame window handling and causes a memory leak.
- No specific patches or version updates were detailed in the disclosure.
On July 14, 2026, a batch of four vulnerabilities affecting the Libsoup HTTP client library was disclosed. These vulnerabilities, spanning denial-of-service (DoS) and out-of-bounds read issues, were published within a one-hour window, indicating a coordinated disclosure event. The vulnerabilities impact various components of Libsoup, including its handling of multipart streams, HTTP/2 frames, and WebSocket connections.
Two moderate-severity vulnerabilities were found in Libsoup's WebSocket handling. CVE-2026-15711, a remote denial-of-service flaw, arises from a protocol violation involving oversized control frames. Separately, CVE-2026-15709, also a moderate-severity DoS vulnerability, stems from unbounded decompression within the permessage-deflate extension. Both issues highlight potential weaknesses in how Libsoup processes WebSocket data.
Further compounding the disclosures, CVE-2026-15714, a moderate-severity vulnerability, involves an out-of-bounds read in the soup_multipart_input_stream_read_headers function. This could be triggered by an oversized multipart boundary string, potentially leading to information disclosure or crashes. The lowest severity vulnerability, CVE-2026-15713, is a low-severity remote denial-of-service flaw in the SoupCache component, caused by an HTTP/2 frame window exhaustion that results in a memory leak.
The disclosed vulnerabilities do not appear to have specific patches or version updates mentioned in the provided details. Users are advised to consult the official Libsoup project for any available updates or mitigation strategies. The coordinated disclosure of these four distinct issues underscores the importance of regular security audits for widely used libraries like Libsoup, which form the backbone of many network-enabled applications.
This batch of vulnerabilities, while not individually critical, collectively presents a risk to applications relying on Libsoup for network communication, particularly concerning denial-of-service conditions and potential memory corruption. Users should remain vigilant for any security advisories or patches released by the Libsoup maintainers.