Summary
USN-8890-1 fixed vulnerabilities in libsoup. This update provides the
corresponding updates for libsoup3 on Ubuntu 26.10.
Original advisory details:
It was discovered that libsoup incorrectly handled certain HTTP/2
requests.
A remote attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.
(CVE-2026-4271)
It was discovered that libsoup incorrectly handled certain HTTPS proxy
connections. A remote attacker could possibly use this issue to obtain
sensitive information. This issue only affected Ubuntu 22.04 LTS, Ubuntu
24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-5119)
It was discovered that libsoup incorrectly parsed certain chunked HTTP
requests. A remote attacker could possibly use this issue to bypass
security controls. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04
LTS, and Ubuntu 26.04 LTS. (CVE-2026-6324)
It was discovered that libsoup incorrectly handled proxy authentication
credentials. A remote attacker could possibly use this issue to obtain
sensitive information. (CVE-2026-66339)
It was discovered that libsoup incorrectly handled certain HTTP Range
headers. A remote attacker could possibly use this issue to cause a denial
of service. (CVE-2026-77014, CVE-2026-77680)
It was discovered that libsoup incorrectly handled certain HTTP/2
connections. A remote attacker could possibly use this issue to obtain
sensitive information or execute arbitrary code. This issue only affected
Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-85197)
It was discovered that libsoup incorrectly handled certain HTTP/2
transfers. A remote attacker could possibly use this issue to cause a
denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04
LTS, and Ubuntu 26.04 LTS. (CVE-2026-85534)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 26.10 | libsoup3 | 3.6.6-1ubuntu3 |
Vulnerabilities 8
-
High 7.6
Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body upload
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server…
-
Medium 6.5
Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination …
-
Medium 5.9
Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment
A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept…
-
Medium 5.9
Libsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body read
A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGS_INITIAL_WINDOW_SIZE whi…
-
Medium 5.3
Libsoup: libsoup: denial of service via use-after-free in http/2 server
A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by sending specially crafted HTTP/2 requests that cause authentica…
-
Medium 5.3
Libsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responses
A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes …
-
Medium 5.3CVE-2026-77680 Public exploit
Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix
An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7…
-
Medium 4.8
Libsoup: libsoup: http request smuggling via unsigned to signed conversion error
A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the `soup_body_input_stream_read_chunked()` function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libso…
References
-
report
https://ubuntu.com/security/CVE-2026-4271
-
report
https://ubuntu.com/security/CVE-2026-5119
-
report
https://ubuntu.com/security/CVE-2026-6324
-
report
https://ubuntu.com/security/CVE-2026-66339
-
report
https://ubuntu.com/security/CVE-2026-77014
-
report
https://ubuntu.com/security/CVE-2026-77680
-
report
https://ubuntu.com/security/CVE-2026-85197
-
report
https://ubuntu.com/security/CVE-2026-85534