rpm package
opensuse/libsoup&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/libsoup&distro=openSUSE%20Tumbleweed
Vulnerabilities (32)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-85534 | Med | 5.9 | < 3.6.6-9.1 | 3.6.6-9.1 | Sep 4, 2026 | A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGS_INITIAL_WINDOW_SIZE while that buffered read | |
| CVE-2026-85197 | Hig | 7.6 | < 3.6.6-9.1 | 3.6.6-9.1 | Sep 4, 2026 | A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame | |
| CVE-2026-12548 | Med | 4.2 | < 3.6.6-8.1 | 3.6.6-8.1 | Jul 21, 2026 | A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could | |
| CVE-2026-12478 | Med | 4.8 | < 3.6.6-7.1 | 3.6.6-7.1 | Jul 14, 2026 | The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to | |
| CVE-2026-2708 | Low | 3.7 | < 3.6.6-1.1 | 3.6.6-1.1 | Apr 23, 2026 | A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. | |
| CVE-2026-2369 | Med | 6.5 | < 3.6.5-13.1 | 3.6.5-13.1 | Mar 19, 2026 | A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This can allow an attacker to potentially access sensitive information or cause an application level denial of service. | |
| CVE-2026-4271 | Med | 5.3 | < 3.6.6-5.1 | 3.6.6-5.1 | Mar 17, 2026 | A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by sending specially crafted HTTP/2 requests that cause authentication failures. This c | |
| CVE-2026-2443 | Med | 5.3 | < 3.6.5-13.1 | 3.6.5-13.1 | Feb 13, 2026 | A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access port | |
| CVE-2026-1761 | Hig | 8.6 | < 3.6.5-12.1 | 3.6.5-12.1 | Feb 2, 2026 | A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by sending a specially crafted multipart HTTP response, which can lead to m | |
| CVE-2026-1760 | Med | 5.3 | < 3.6.6-2.1 | 3.6.6-2.1 | Feb 2, 2026 | A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine Transfer-Encoding: chunked and Connection: keep-alive headers. A remote, unauthenticated client can exploit this by sending specially craft | |
| CVE-2026-1539 | Med | 5.8 | < 3.6.6-2.1 | 3.6.6-2.1 | Jan 28, 2026 | A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTTP redirects, libsoup removes the Authorization header but does not remove the Proxy-Authorization header if the request is redirect | |
| CVE-2026-1536 | Med | 5.8 | < 3.6.5-12.1 | 3.6.5-12.1 | Jan 28, 2026 | A flaw was found in libsoup. An attacker who can control the input for the Content-Disposition header can inject CRLF (Carriage Return Line Feed) sequences into the header value. These sequences are then interpreted verbatim when the HTTP request or response is constructed, allow | |
| CVE-2026-1467 | Med | 5.8 | < 3.6.6-2.1 | 3.6.6-2.1 | Jan 27, 2026 | A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF (Carriage Return Line Feed) Injection, occurs when an HTTP proxy is configured and the library improperly handles URL-decoded input used to create the Host header. A remote attacker can exploit | |
| CVE-2026-0716 | Med | 4.8 | < 3.6.5-11.1 | 3.6.5-11.1 | Jan 13, 2026 | A flaw was found in libsoup’s WebSocket frame processing when handling incoming messages. If a non-default configuration is used where the maximum incoming payload size is unset, the library may read memory outside the intended bounds. This can cause unintended memory exposure or | |
| CVE-2026-0719 | Hig | 8.6 | < 3.6.5-11.1 | 3.6.5-11.1 | Jan 8, 2026 | A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication. When processing extremely long passwords, an internal size calculation can overflow due to improper use of signed integers. This | |
| CVE-2025-14523 | Hig | 8.2 | < 3.6.5-10.1 | 3.6.5-10.1 | Dec 11, 2025 | A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to on | |
| CVE-2025-12105 | Hig | 7.5 | < 3.6.5-9.1 | 3.6.5-9.1 | Oct 23, 2025 | A flaw was found in the asynchronous message queue handling of the libsoup library, widely used by GNOME and WebKit-based applications to manage HTTP/2 communications. When network operations are aborted at specific timing intervals, an internal message queue item may be freed tw | |
| CVE-2025-11021 | Hig | 7.5 | < 3.6.5-7.1 | 3.6.5-7.1 | Sep 26, 2025 | A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communication. When processing cookies with specially crafted expiration dates, the library may perform an out-of-bounds memory read. This flaw coul | |
| CVE-2025-4969 | Med | 6.5 | < 3.6.5-5.1 | 3.6.5-5.1 | May 21, 2025 | A vulnerability was found in the libsoup package. This flaw stems from its failure to correctly verify the termination of multipart HTTP messages. This can allow a remote attacker to send a specially crafted multipart HTTP body, causing the libsoup-consuming server to read beyond | |
| CVE-2025-4945 | Low | 3.7 | < 3.6.5-6.1 | 3.6.5-6.1 | May 19, 2025 | A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. This may result in un |
- affected < 3.6.6-9.1fixed 3.6.6-9.1
A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGS_INITIAL_WINDOW_SIZE while that buffered read
- affected < 3.6.6-9.1fixed 3.6.6-9.1
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame
- affected < 3.6.6-8.1fixed 3.6.6-8.1
A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could
- affected < 3.6.6-7.1fixed 3.6.6-7.1
The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to
- affected < 3.6.6-1.1fixed 3.6.6-1.1
A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields.
- affected < 3.6.5-13.1fixed 3.6.5-13.1
A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This can allow an attacker to potentially access sensitive information or cause an application level denial of service.
- affected < 3.6.6-5.1fixed 3.6.6-5.1
A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by sending specially crafted HTTP/2 requests that cause authentication failures. This c
- affected < 3.6.5-13.1fixed 3.6.5-13.1
A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access port
- affected < 3.6.5-12.1fixed 3.6.5-12.1
A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by sending a specially crafted multipart HTTP response, which can lead to m
- affected < 3.6.6-2.1fixed 3.6.6-2.1
A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine Transfer-Encoding: chunked and Connection: keep-alive headers. A remote, unauthenticated client can exploit this by sending specially craft
- affected < 3.6.6-2.1fixed 3.6.6-2.1
A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTTP redirects, libsoup removes the Authorization header but does not remove the Proxy-Authorization header if the request is redirect
- affected < 3.6.5-12.1fixed 3.6.5-12.1
A flaw was found in libsoup. An attacker who can control the input for the Content-Disposition header can inject CRLF (Carriage Return Line Feed) sequences into the header value. These sequences are then interpreted verbatim when the HTTP request or response is constructed, allow
- affected < 3.6.6-2.1fixed 3.6.6-2.1
A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF (Carriage Return Line Feed) Injection, occurs when an HTTP proxy is configured and the library improperly handles URL-decoded input used to create the Host header. A remote attacker can exploit
- affected < 3.6.5-11.1fixed 3.6.5-11.1
A flaw was found in libsoup’s WebSocket frame processing when handling incoming messages. If a non-default configuration is used where the maximum incoming payload size is unset, the library may read memory outside the intended bounds. This can cause unintended memory exposure or
- affected < 3.6.5-11.1fixed 3.6.5-11.1
A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication. When processing extremely long passwords, an internal size calculation can overflow due to improper use of signed integers. This
- affected < 3.6.5-10.1fixed 3.6.5-10.1
A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to on
- affected < 3.6.5-9.1fixed 3.6.5-9.1
A flaw was found in the asynchronous message queue handling of the libsoup library, widely used by GNOME and WebKit-based applications to manage HTTP/2 communications. When network operations are aborted at specific timing intervals, an internal message queue item may be freed tw
- affected < 3.6.5-7.1fixed 3.6.5-7.1
A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communication. When processing cookies with specially crafted expiration dates, the library may perform an out-of-bounds memory read. This flaw coul
- affected < 3.6.5-5.1fixed 3.6.5-5.1
A vulnerability was found in the libsoup package. This flaw stems from its failure to correctly verify the termination of multipart HTTP messages. This can allow a remote attacker to send a specially crafted multipart HTTP body, causing the libsoup-consuming server to read beyond
- affected < 3.6.5-6.1fixed 3.6.5-6.1
A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. This may result in un
Page 1 of 2