Critical Security Flaw in libsoup3: Stack-Based Buffer Overflow Vulnerability
Summary
ALSA-2026:2410: Important: libsoup3 security update. Affects libsoup3 versions < 3.6.5-3.el10_1.10. Fixed in 3.6.5-3.el10_1.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libsoup is an HTTP library implementation in C, designed to facilitate asynchronous communication for GNOME applications. It allows these applications to interact with HTTP servers efficiently, leveraging the Glib main loop. Originally part of a SOAP implementation, libsoup has evolved to focus on HTTP functionalities, providing both synchronous and asynchronous operation modes. However, a recent vulnerability has been identified that could compromise the security of applications utilizing this library.
Vulnerability Detail
The vulnerability identified as CVE-2026-1761 is a stack-based buffer overflow occurring during the parsing of multipart HTTP responses in libsoup. This flaw can potentially allow an attacker to execute arbitrary code, leading to unauthorized access or control over affected systems. The issue arises from improper handling of multipart responses, which can be exploited by crafting malicious HTTP requests.
How To Fix
Minimum fixed version
3.6.5-3.el10_1.10
This is the first release that contains the fix.
sudo dnf update libsoup3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the available security update as soon as possible.
Conclusion
The libsoup3 library has a critical vulnerability that could lead to severe security risks for applications relying on it. It is crucial to update to the latest patched version to protect against potential exploits. Regular monitoring for vulnerabilities using tools like Vulert can further enhance application security.
See every vulnerability recorded for libsoup3 →
FAQ
CVE-2026-1761 is a security vulnerability in libsoup3 that allows for a stack-based buffer overflow during multipart HTTP response parsing.
If your application uses libsoup3, it may be susceptible to remote code execution attacks, potentially allowing attackers to gain unauthorized access.
Update libsoup3 and related packages to version 3.6.5-3.el10_1.10 or later to mitigate the risk associated with this vulnerability.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by CVE-2026-1761 without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for libsoup3.
