Critical Stack-Based Buffer Overflow in libsoup3: Important Security Update
Summary
RLSA-2026:2410: Important: libsoup3 security update. Affects libsoup3 versions < 0:3.6.5-3.el10_1.10. Fixed in 0:3.6.5-3.el10_1.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libsoup is an HTTP library implementation in C, designed to facilitate asynchronous communication between GNOME applications and HTTP servers. Originally part of a SOAP implementation, libsoup has evolved to focus solely on HTTP functionalities, leveraging the Glib main loop for efficient operation. This library is integral for applications that require network communication, making its security paramount.
Vulnerability Detail
The vulnerability identified as CVE-2026-1761 is a stack-based buffer overflow that occurs during the parsing of multipart HTTP responses in libsoup. This flaw can be exploited by an attacker to execute arbitrary code, potentially compromising the integrity and availability of affected systems. The vulnerability arises from improper handling of input data, leading to memory corruption and unpredictable behavior in applications utilizing the library.
How To Fix
Minimum fixed version
0:3.6.5-3.el10_1.10
This is the first release that contains the fix.
sudo dnf update libsoup3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider limiting the exposure of applications using libsoup to untrusted or potentially malicious HTTP responses. Implementing strict input validation and sanitization can also mitigate the risk until the update is applied.
Conclusion
The libsoup3 vulnerability CVE-2026-1761 poses a significant risk due to its potential for arbitrary code execution. It is crucial for users to update to the latest patched version to safeguard their applications. Temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for libsoup3 →
FAQ
Libsoup is an HTTP library in C that allows GNOME applications to communicate with HTTP servers asynchronously.
CVE-2026-1761 refers to a stack-based buffer overflow vulnerability in libsoup that can lead to arbitrary code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 8.6, indicating a critical level of severity.
If an immediate update is not possible, consider implementing input validation and limiting exposure to untrusted HTTP responses as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for libsoup3.
