Moderate Security Vulnerability in libsoup3: Denial of Service and Information Disclosure
Summary
RLSA-2026:15968: Moderate: libsoup3 security update. Affects libsoup3 versions < 0:3.6.5-3.el10_1.11. Fixed in 0:3.6.5-3.el10_1.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libsoup is an HTTP library implementation in C, originally part of a SOAP implementation called Soup. It has since been split into separate packages, with libsoup focusing on HTTP communication. Designed to work seamlessly with GTK applications, libsoup allows GNOME applications to access HTTP servers asynchronously, enhancing performance and user experience. However, recent vulnerabilities have been identified that could compromise the security of applications utilizing this library.
Vulnerability Detail
The vulnerabilities in libsoup3 include a Denial of Service (DoS) attack due to a Use-After-Free error in the HTTP/2 server (CVE-2026-4271) and an Information Disclosure issue where cookies are transmitted in cleartext during HTTPS tunnel establishment (CVE-2026-5119). These vulnerabilities can lead to service interruptions and unauthorized access to sensitive information, posing significant risks to applications relying on this library.
How To Fix
Minimum fixed version
0:3.6.5-3.el10_1.11
This is the first release that contains the fix.
sudo dnf update libsoup3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling HTTP/2 support in your application if feasible, or implement additional security measures to encrypt sensitive data during transmission.
Conclusion
The vulnerabilities identified in libsoup3 pose significant risks to applications utilizing this library. It is crucial to update to the patched version to mitigate these risks and ensure the security of your applications.
See every vulnerability recorded for libsoup3 →
FAQ
Libsoup is an HTTP library for C that allows applications to communicate with HTTP servers in an asynchronous manner.
The main vulnerabilities include a Denial of Service due to a Use-After-Free error and Information Disclosure through cleartext cookie transmission.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for these vulnerabilities is 5.9, indicating a moderate level of risk.
You can update libsoup3 by running the command 'sudo dnf update libsoup3' in your terminal.
Related vulnerabilities
Recent vulnerabilities recorded for libsoup3.
