Moderate Security Vulnerability in libsoup3: Denial of Service and Information Disclosure Risks
Summary
ALSA-2026:15968: Moderate: libsoup3 security update. Affects libsoup3 versions < 3.6.5-3.el10_1.11. Fixed in 3.6.5-3.el10_1.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Libsoup is an HTTP library implementation in C, designed to facilitate asynchronous HTTP communication for GNOME applications. Originally part of a SOAP implementation, it has since been split into separate packages, focusing on providing a robust HTTP client and server functionality. The library leverages the Glib main loop, making it compatible with GTK applications, and supports both asynchronous and synchronous operation modes. However, recent vulnerabilities have been identified that could compromise the security of applications relying on this library.
Vulnerability Detail
The vulnerabilities in libsoup3 include a Denial of Service (DoS) issue due to a Use-After-Free condition in the HTTP/2 server (CVE-2026-4271) and an Information Disclosure risk stemming from the cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119). These vulnerabilities can lead to application crashes and unauthorized access to sensitive information, respectively, posing significant risks to user data and application integrity.
How To Fix
Minimum fixed version
3.6.5-3.el10_1.11
This is the first release that contains the fix.
sudo dnf update libsoup3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling HTTP/2 support in your application if feasible, or implement additional security measures to monitor and restrict access to sensitive data during HTTPS tunnel establishment.
Conclusion
The identified vulnerabilities in libsoup3 pose significant risks to applications relying on this library for HTTP communication. It is crucial to update to the patched version to ensure the security and integrity of your applications. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for libsoup3 →
FAQ
Libsoup3 is an HTTP library in C that allows GNOME applications to communicate with HTTP servers asynchronously.
The main vulnerabilities include a Denial of Service via Use-After-Free in the HTTP/2 server and Information Disclosure through cleartext cookie transmission during HTTPS tunnel establishment.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
Update libsoup3 and related packages to the latest patched version as soon as possible to mitigate the identified vulnerabilities.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for libsoup3.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
