Description
The soup_headers_parse function in soup-headers.c for libsoup HTTP library before 2.2.99 allows remote attackers to cause a denial of service (crash) via malformed HTTP headers, probably involving missing fields or values.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libsoup | 2.2.98-2 | — |
| Debian 3.1 | libsoup | 2.2.3-2sarge1 | DSA-1248-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libsoup | 2.72.0-2.5 | openSUSE-SU-2024:10994-1 |
Advisories 2
- DSA-1248-1 libsoup Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10994-1 libsoup-2_4-1-2.72.0-2.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- DSA-1248 vendor-advisory
- 22034 vdb-entry
- https://issues.rpath.com/browse/RPL-965
- 23961 third-party-advisory
- 23734 third-party-advisory
- ADV-2007-0173 vdb-entry
- http://ftp.gnome.org/pub/gnome/sources/libsoup/2.2/libsoup-2.2.99.news
- 31667 vdb-entry
- MDKSA-2007:029 vendor-advisory
- FEDORA-2007-109 vendor-advisory
- 23871 third-party-advisory
- 23770 third-party-advisory
- 23873 third-party-advisory
- USN-411-1 vendor-advisory
- 23976 third-party-advisory
- libsoup-soupheadersparse-dos(31519) vdb-entry