Description
libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soup_ntlm_parse_challenge() in soup-auth-ntlm.c does not properly check an NTLM message's length before proceeding with a memcpy.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | libsoup2.4 | 2.68.2-1 | — |
| Debian 12 | libsoup2.4 | 2.68.2-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libsoup2.4 | 2.62.1-1ubuntu0.4 | USN-4152-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.23 | libsoup | 2.68.2-r0 | — |
| Alpine v3.22 | libsoup | 2.68.2-r0 | — |
| Alpine v3.21 | libsoup | 2.68.2-r0 | — |
| Alpine v3.20 | libsoup | 2.68.2-r0 | — |
| Alpine v3.19 | libsoup | 2.68.2-r0 | — |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.18 | libsoup | 2.68.2-r0 | — |
| Alpine v3.17 | libsoup | 2.68.2-r0 | — |
| Alpine v3.16 | libsoup | 2.68.2-r0 | — |
| Alpine v3.15 | libsoup | 2.68.2-r0 | — |
| Alpine v3.14 | libsoup | 2.68.2-r0 | — |
| Alpine v3.13 | libsoup | 2.68.2-r0 | — |
| Alpine v3.12 | libsoup | 2.68.2-r0 | — |
| Alpine v3.11 | libsoup | 2.68.2-r0 | — |
| Alpine v3.10 | libsoup | 2.66.2-r2 | — |
Advisories 1
- USN-4152-1 libsoup2.4 vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
References
- https://gitlab.gnome.org/GNOME/libsoup/issues/173
- https://security-tracker.debian.org/tracker/CVE-2019-17266
- https://gitlab.gnome.org/GNOME/libsoup/commit/88b7dff4467f4151afae244ea7d1223753cd05ab
- https://github.com/Kirin-say/Vulnerabilities/blob/master/CVE-2019-17266_POC.md
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=941912
- https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1705054.html
- https://gitlab.gnome.org/GNOME/libsoup/commit/f8a54ac85eec2008c85393f331cdd251af8266ad
- USN-4152-1 vendor-advisory