Moderate Security Vulnerability in libsoup3: Denial of Service and Information Disclosure
Summary
ALSA-2026:19143: Moderate: libsoup3 security update. Affects libsoup3 versions < 3.6.5-3.el10_2.11. Fixed in 3.6.5-3.el10_2.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libsoup is an HTTP library implementation in C, designed to facilitate asynchronous network communication for GNOME applications. It allows these applications to access HTTP servers efficiently, leveraging the Glib main loop. Originally part of a SOAP implementation, libsoup has evolved to focus solely on HTTP functionalities, making it a critical component for developers working with networked applications in the GNOME ecosystem.
Vulnerability Detail
The libsoup3 package has been identified with two significant vulnerabilities: a Denial of Service (DoS) issue due to a Use-After-Free condition in the HTTP/2 server (CVE-2026-4271) and an Information Disclosure risk stemming from the cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119). These vulnerabilities can lead to service interruptions and unauthorized access to sensitive information, respectively.
How To Fix
Minimum fixed version
3.6.5-3.el10_2.11
This is the first release that contains the fix.
sudo dnf update libsoup3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users may consider disabling HTTP/2 support in their applications until the update can be applied. This can typically be done by modifying the application's configuration settings to revert to HTTP/1.1.
Conclusion
The libsoup3 package has critical vulnerabilities that could lead to service disruptions and information leaks. It is crucial to update to the latest version to ensure the security of applications relying on this library. Users are encouraged to monitor their systems and apply updates promptly.
See every vulnerability recorded for libsoup3 →
FAQ
Libsoup is an HTTP library in C that allows GNOME applications to communicate with HTTP servers asynchronously.
The main vulnerabilities include a Denial of Service via Use-After-Free in the HTTP/2 server and Information Disclosure through cleartext cookie transmission during HTTPS tunnel establishment.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check your application without needing to sign up.
As a workaround, consider disabling HTTP/2 support in your application until you can apply the necessary updates.
For detailed information about the vulnerabilities, refer to the CVE pages linked in the advisory or check the official documentation for libsoup.
Related vulnerabilities
Recent vulnerabilities recorded for libsoup3.
