rpm package
opensuse/libsoup2&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/libsoup2&distro=openSUSE%20Tumbleweed
Vulnerabilities (45)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-102560 | Hig | 8.6 | < 2.74.3-24.1 | 2.74.3-24.1 | Sep 29, 2026 | A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow. | |
| CVE-2026-102559 | Hig | 8.6 | < 2.74.3-24.1 | 2.74.3-24.1 | Sep 29, 2026 | A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow. | |
| CVE-2026-102558 | Hig | 8.6 | < 2.74.3-24.1 | 2.74.3-24.1 | Sep 29, 2026 | A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data. | |
| CVE-2026-102557 | Hig | 8.6 | < 2.74.3-24.1 | 2.74.3-24.1 | Sep 29, 2026 | A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementat | |
| CVE-2026-102556 | Hig | 8.6 | < 2.74.3-24.1 | 2.74.3-24.1 | Sep 29, 2026 | A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API c | |
| CVE-2026-77680 | Med | 5.3 | < 2.74.3-23.1 | 2.74.3-23.1 | Aug 25, 2026 | An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge co | |
| CVE-2026-77014 | Med | 5.3 | < 2.74.3-23.1 | 2.74.3-23.1 | Aug 20, 2026 | A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of re | |
| CVE-2026-66339 | Med | 6.5 | < 2.74.3-24.1 | 2.74.3-24.1 | Jul 24, 2026 | A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture pro | |
| CVE-2026-12548 | Med | 4.2 | < 2.74.3-22.1 | 2.74.3-22.1 | Jul 21, 2026 | A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could | |
| CVE-2026-12547 | Low | 3.4 | < 2.74.3-24.1 | 2.74.3-24.1 | Jul 21, 2026 | SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking | |
| CVE-2026-15714 | Med | 6.5 | < 2.74.3-24.1 | 2.74.3-24.1 | Jul 14, 2026 | An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists in the soup_multipart_input_stream_read_headers() function inside soup-multipart-input-stream.c, which does not adequately restrict or validate the size of incoming multipar | |
| CVE-2026-15711 | Hig | 7.5 | < 2.74.3-24.1 | 2.74.3-24.1 | Jul 14, 2026 | A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or less. A remote, unaut | |
| CVE-2026-12478 | Med | 4.8 | < 2.74.3-24.1 | 2.74.3-24.1 | Jul 14, 2026 | The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to | |
| CVE-2026-2708 | Low | 3.7 | < 2.74.3-17.1 | 2.74.3-17.1 | Apr 23, 2026 | A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. | |
| CVE-2026-2369 | Med | 6.5 | < 2.74.3-16.1 | 2.74.3-16.1 | Mar 19, 2026 | A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This can allow an attacker to potentially access sensitive information or cause an application level denial of service. | |
| CVE-2026-2443 | Med | 5.3 | < 2.74.3-16.1 | 2.74.3-16.1 | Feb 13, 2026 | A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access port | |
| CVE-2026-1801 | Med | 5.3 | < 2.74.3-21.1 | 2.74.3-21.1 | Feb 3, 2026 | A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters ins | |
| CVE-2026-1761 | Hig | 8.6 | < 2.74.3-15.1 | 2.74.3-15.1 | Feb 2, 2026 | A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by sending a specially crafted multipart HTTP response, which can lead to m | |
| CVE-2026-1760 | Med | 5.3 | < 2.74.3-18.1 | 2.74.3-18.1 | Feb 2, 2026 | A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine Transfer-Encoding: chunked and Connection: keep-alive headers. A remote, unauthenticated client can exploit this by sending specially craft | |
| CVE-2026-1539 | Med | 5.8 | < 2.74.3-18.1 | 2.74.3-18.1 | Jan 28, 2026 | A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTTP redirects, libsoup removes the Authorization header but does not remove the Proxy-Authorization header if the request is redirect |
- affected < 2.74.3-24.1fixed 2.74.3-24.1
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.
- affected < 2.74.3-24.1fixed 2.74.3-24.1
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.
- affected < 2.74.3-24.1fixed 2.74.3-24.1
A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data.
- affected < 2.74.3-24.1fixed 2.74.3-24.1
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementat
- affected < 2.74.3-24.1fixed 2.74.3-24.1
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API c
- affected < 2.74.3-23.1fixed 2.74.3-23.1
An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge co
- affected < 2.74.3-23.1fixed 2.74.3-23.1
A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of re
- affected < 2.74.3-24.1fixed 2.74.3-24.1
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture pro
- affected < 2.74.3-22.1fixed 2.74.3-22.1
A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could
- affected < 2.74.3-24.1fixed 2.74.3-24.1
SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking
- affected < 2.74.3-24.1fixed 2.74.3-24.1
An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists in the soup_multipart_input_stream_read_headers() function inside soup-multipart-input-stream.c, which does not adequately restrict or validate the size of incoming multipar
- affected < 2.74.3-24.1fixed 2.74.3-24.1
A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or less. A remote, unaut
- affected < 2.74.3-24.1fixed 2.74.3-24.1
The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to
- affected < 2.74.3-17.1fixed 2.74.3-17.1
A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields.
- affected < 2.74.3-16.1fixed 2.74.3-16.1
A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This can allow an attacker to potentially access sensitive information or cause an application level denial of service.
- affected < 2.74.3-16.1fixed 2.74.3-16.1
A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access port
- affected < 2.74.3-21.1fixed 2.74.3-21.1
A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters ins
- affected < 2.74.3-15.1fixed 2.74.3-15.1
A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by sending a specially crafted multipart HTTP response, which can lead to m
- affected < 2.74.3-18.1fixed 2.74.3-18.1
A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine Transfer-Encoding: chunked and Connection: keep-alive headers. A remote, unauthenticated client can exploit this by sending specially craft
- affected < 2.74.3-18.1fixed 2.74.3-18.1
A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTTP redirects, libsoup removes the Authorization header but does not remove the Proxy-Authorization header if the request is redirect
Page 1 of 3