Critical Security Flaws in libsoup3: Buffer Overflow Vulnerabilities
Summary
ALSA-2026:2182: Important: libsoup3 security update. Affects libsoup3 versions < 3.6.5-3.el10_1.9. Fixed in 3.6.5-3.el10_1.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libsoup is an HTTP library implementation in C, originally part of a SOAP (Simple Object Access Protocol) implementation called Soup. It has been separated into distinct packages for SOAP and non-SOAP functionalities. Libsoup utilizes the Glib main loop, making it compatible with GTK applications, allowing GNOME applications to access HTTP servers asynchronously. This library is essential for developers working with network communications in GNOME environments, but it has recently been found to have critical vulnerabilities that could compromise system security.
Vulnerability Detail
The vulnerabilities in libsoup3 stem from a signed to unsigned conversion error leading to a stack-based buffer overflow during NTLM authentication (CVE-2026-0719) and a stack-based buffer overflow in multipart response parsing (CVE-2026-1761). These flaws could allow attackers to execute arbitrary code, potentially leading to unauthorized access or system crashes. The vulnerabilities arise from improper handling of data, which can be exploited if an attacker sends specially crafted HTTP requests.
How To Fix
Minimum fixed version
3.6.5-3.el10_1.9
This is the first release that contains the fix.
sudo dnf update libsoup3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the affected services or implement network-level controls to filter out potentially malicious requests until the package is updated. Additionally, consider using alternative libraries for HTTP communications if immediate patching is not feasible.
Conclusion
The libsoup3 library has critical vulnerabilities that could lead to severe security issues if not addressed. Updating to the latest patched version is crucial for maintaining the integrity and security of applications that rely on this library. Regular monitoring and updates are essential to safeguard against potential threats.
See every vulnerability recorded for libsoup3 →
FAQ
Libsoup3 is an HTTP library designed for C programming, primarily used in GNOME applications to facilitate asynchronous network communications.
The vulnerabilities include a signed to unsigned conversion error leading to a stack-based buffer overflow and a stack-based buffer overflow in multipart response parsing.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application using the Vulert playground at Vulert Scanner without needing to sign up.
Exploitation of these vulnerabilities could lead to arbitrary code execution, unauthorized access, or system crashes, posing significant security risks.
It is recommended to regularly check for updates and apply security patches as soon as they are available to minimize the risk of vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for libsoup3.
