Critical Buffer Overflow Vulnerability in libsoup Package
Summary
ALSA-2026:2215: Important: libsoup security update. Affects libsoup versions < 2.62.3-13.el8_10. Fixed in 2.62.3-13.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libsoup is an HTTP client and server library designed for GNOME applications, providing essential functionalities for handling HTTP requests and responses. It is widely used in various applications to facilitate network communication. However, recent vulnerabilities have been identified that could compromise the security of applications relying on this library.
Vulnerability Detail
The libsoup package has two significant vulnerabilities. The first is a signed to unsigned conversion error during NTLM authentication (CVE-2026-0719), which can lead to a stack-based buffer overflow. The second vulnerability involves a stack-based buffer overflow in the parsing of multipart HTTP responses (CVE-2026-1761). Both vulnerabilities can potentially allow attackers to execute arbitrary code, leading to severe security breaches.
How To Fix
Minimum fixed version
2.62.3-13.el8_10
This is the first release that contains the fix.
sudo dnf update libsoupTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to applications using libsoup until the packages are updated. Additionally, review and validate any incoming HTTP requests to mitigate potential exploitation.
Conclusion
The libsoup package has critical vulnerabilities that could lead to severe security risks. It is essential to update to the latest patched versions to safeguard your applications. Utilizing tools like Vulert can help monitor and identify vulnerabilities in your software effectively.
See every vulnerability recorded for libsoup →
FAQ
libsoup is a library that provides an HTTP client and server functionality for GNOME applications, enabling them to communicate over the web.
The vulnerabilities could allow attackers to execute arbitrary code, potentially compromising the integrity and confidentiality of the affected applications.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Yes, you can restrict access to applications using libsoup and validate incoming HTTP requests to reduce the risk of exploitation.
It is recommended to regularly check for updates and apply them promptly to ensure your software is protected against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for libsoup.
