CVE-2026-1761
published 2026-02-02CVE-2026-1761: A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an incorrect length…
PriorityP263high8.6CVSS 3.1
AVNACLPRNUINSUCLIHAL
EPSS
1.07%
64.7th percentile
A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by sending a specially crafted multipart HTTP response, which can lead to memory corruption. This issue may result in application crashes or arbitrary code execution in applications that process untrusted server responses, and it does not require authentication or user interaction.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libsoup2.4 | < libsoup3 3.6.5-8 (forky) | libsoup3 3.6.5-8 (forky) |
| debian | libsoup3 | < libsoup3 3.6.5-8 (forky) | libsoup3 3.6.5-8 (forky) |
| debian | libsoup3 | — | — |
| gnome | libsoup | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Focus detection on the specific function soup_filter_input_stream_read_until() as the vulnerable code path; crash telemetry or stack canary violations in this function are indicative of exploitation attempts. ↗
- →Exploitation does not require authentication or user interaction; any application using libsoup to process HTTP responses from untrusted servers is at risk. Network-level detection should look for anomalously large or malformed multipart/form-data HTTP responses. ↗
- ·Red Hat recommends restricting vulnerable libsoup-based applications to only communicate with trusted endpoints as a mitigation; network egress filtering should be applied to reduce exposure. ↗
- ·libsoup on Red Hat Enterprise Linux 6 is out of support scope and will not receive a patch; systems running RHEL 6 with libsoup remain permanently exposed. ↗
- ·Debian bookworm, bullseye, and trixie all have open (unpatched) status for this CVE at time of source capture. ↗
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
osv8.6HIGH
vendor_debian8.6HIGH
vendor_redhat8.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
vendor_redhat·2026-07-19·CVSS 7.8
CVE-2026-63812 [HIGH] CWE-821 kernel: f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
kernel: f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
When __destroy_extent_node() sets the inode flag FI_NO_EXTENT, it does
not reset the length of the largest extent to 0 and update the inode
folio. Since modifications to the extent tree are disallowed afterward,
the cached largest extent may become stale. This can trigger the
following error in xfstests generic/388:
F2FS-fs (dm-0): sanity_check_extent_cache: inode (ino=1761) extent info [220057, 57, 6] is incorrect, run fsck to fix
In the f2fs_drop_inode path, __destroy_extent_node() does not need to
guarantee that et->node_cnt is 0, because concurrency with writeback
is expecte
Red Hat
libsoup: libsoup: Heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()
vendor_redhat·2026-06-05·CVSS 8.6
CVE-2026-66337 [HIGH] CWE-125 libsoup: libsoup: Heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()
libsoup: libsoup: Heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()
A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory.
Statement: A flaw was found in libsoup where an unsigned integer underflow in soup_filter_input_stream_read_until() causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can trigger this against any libsoup client using SoupMultipartInputStream by sending a crafted multipart response with a boundary st
Red Hat
libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response
vendor_redhat·2026-02-02·CVSS 8.6
CVE-2026-1761 [HIGH] CWE-121 libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response
libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response
A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by sending a specially crafted multipart HTTP response, which can lead to memory corruption. This issue may result in application crashes or arbitrary code execution in applications that process untrusted server responses, and it does not require authentication or user interaction.
A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by send
Debian
CVE-2026-1761: libsoup2.4 - A flaw was found in libsoup. This stack-based buffer overflow vulnerability occu...
vendor_debian·2026·CVSS 8.6
CVE-2026-1761 [HIGH] CVE-2026-1761: libsoup2.4 - A flaw was found in libsoup. This stack-based buffer overflow vulnerability occu...
A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by sending a specially crafted multipart HTTP response, which can lead to memory corruption. This issue may result in application crashes or arbitrary code execution in applications that process untrusted server responses, and it does not require authentication or user interaction.
Scope: local
bookworm: open
bullseye: open
trixie: open
GHSA
GHSA-6j8r-j98h-9g9f: A flaw was found in libsoup
ghsa_unreviewed·2026-02-02
CVE-2026-1761 [HIGH] CWE-121 GHSA-6j8r-j98h-9g9f: A flaw was found in libsoup
A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by sending a specially crafted multipart HTTP response, which can lead to memory corruption. This issue may result in application crashes or arbitrary code execution in applications that process untrusted server responses, and it does not require authentication or user interaction.
OSV
CVE-2026-1761: A flaw was found in libsoup
osv·2026-02-02·CVSS 8.6
CVE-2026-1761 [HIGH] CVE-2026-1761: A flaw was found in libsoup
A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by sending a specially crafted multipart HTTP response, which can lead to memory corruption. This issue may result in application crashes or arbitrary code execution in applications that process untrusted server responses, and it does not require authentication or user interaction.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-66337 libsoup: libsoup: Heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()
bugzilla·2026-07-24·CVSS 8.6
CVE-2026-66337 [HIGH] CVE-2026-66337 libsoup: libsoup: Heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()
CVE-2026-66337 libsoup: libsoup: Heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()
An unsigned integer underflow in soup_filter_input_stream_read_until() in libsoup/soup-filter-input-stream.c causes a heap buffer over-read when parsing multipart HTTP responses. When include_boundary is FALSE and the internal buffer contains fewer bytes than the boundary string length, the subtraction of two unsigned values wraps to a very large number, causing the boundary scan loop to read beyond the heap allocation. A malicious HTTP server can trigger this against any libsoup client using SoupMultipartInputStream. This is related to but distinct from CVE-2026-1761 — Red Hat's downstream fix for that CVE does not resolve this issue.
Upstream report: https://gitlab.gnom
Bugzilla
CVE-2026-63812 kernel: f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
bugzilla·2026-07-19·CVSS 7.8
CVE-2026-63812 [HIGH] CVE-2026-63812 kernel: f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
CVE-2026-63812 kernel: f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
When __destroy_extent_node() sets the inode flag FI_NO_EXTENT, it does
not reset the length of the largest extent to 0 and update the inode
folio. Since modifications to the extent tree are disallowed afterward,
the cached largest extent may become stale. This can trigger the
following error in xfstests generic/388:
F2FS-fs (dm-0): sanity_check_extent_cache: inode (ino=1761) extent info [220057, 57, 6] is incorrect, run fsck to fix
In the f2fs_drop_inode path, __destroy_extent_node() does not need to
guarantee that et->node_cnt is 0, because concurrency with w
Bugzilla
CVE-2026-1761 mingw-libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response [fedora-all]
bugzilla·2026-02-02·CVSS 8.6
CVE-2026-1761 [HIGH] CVE-2026-1761 mingw-libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response [fedora-all]
CVE-2026-1761 mingw-libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-1761 libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response
bugzilla·2026-02-02·CVSS 8.6
CVE-2026-1761 [HIGH] CVE-2026-1761 libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response
CVE-2026-1761 libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response
Stack-based buffer overflow vulnerability in libsoup’s multipart/form-data response parsing logic. The flaw exists in the soup_filter_input_stream_read_until() function, where an incorrect length calculation may cause more data to be copied than the size of the caller-provided buffer. When a specially crafted multipart HTTP response is processed, libsoup can write past the end of a stack buffer, resulting in memory corruption. This issue can be triggered remotely without authentication or user interaction, potentially leading to application crashes or arbitrary code execution in applications that parse untrusted server responses.
Discussion:
This issue has been addressed in th
Wiz
CVE-2026-1761 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.6
CVE-2026-1761 [HIGH] CVE-2026-1761 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-1761 :
Rocky Linux vulnerability analysis and mitigation
A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by sending a specially crafted multipart HTTP response, which can lead to memory corruption. This issue may result in application crashes or arbitrary code execution in applications that process untrusted server responses, and it does not require authentication or user interaction.
Source : NVD
## 8.6
Score
Published February 2, 2026
Severity HIGH
CNA Score 8.6
Affected Technologies
Rocky Linux
Alma Linux
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Explo
https://access.redhat.com/errata/RHSA-2026:1948https://access.redhat.com/errata/RHSA-2026:2005https://access.redhat.com/errata/RHSA-2026:2006https://access.redhat.com/errata/RHSA-2026:2007https://access.redhat.com/errata/RHSA-2026:2008https://access.redhat.com/errata/RHSA-2026:2049https://access.redhat.com/errata/RHSA-2026:2182https://access.redhat.com/errata/RHSA-2026:2214https://access.redhat.com/errata/RHSA-2026:2215https://access.redhat.com/errata/RHSA-2026:2216https://access.redhat.com/errata/RHSA-2026:2396https://access.redhat.com/errata/RHSA-2026:2402https://access.redhat.com/errata/RHSA-2026:2410https://access.redhat.com/errata/RHSA-2026:2512https://access.redhat.com/errata/RHSA-2026:2513https://access.redhat.com/errata/RHSA-2026:2514https://access.redhat.com/errata/RHSA-2026:2528https://access.redhat.com/errata/RHSA-2026:2529https://access.redhat.com/errata/RHSA-2026:2628https://access.redhat.com/errata/RHSA-2026:2844https://access.redhat.com/security/cve/CVE-2026-1761https://bugzilla.redhat.com/show_bug.cgi?id=2435961https://gitlab.gnome.org/GNOME/libsoup/-/issues/493https://access.redhat.com/errata/RHSA-2026:1948https://access.redhat.com/errata/RHSA-2026:2005https://access.redhat.com/errata/RHSA-2026:2006https://access.redhat.com/errata/RHSA-2026:2007https://access.redhat.com/errata/RHSA-2026:2008https://access.redhat.com/errata/RHSA-2026:2049https://access.redhat.com/errata/RHSA-2026:2182https://access.redhat.com/errata/RHSA-2026:2214https://access.redhat.com/errata/RHSA-2026:2215https://access.redhat.com/errata/RHSA-2026:2216https://access.redhat.com/errata/RHSA-2026:2396https://access.redhat.com/errata/RHSA-2026:2402https://access.redhat.com/errata/RHSA-2026:2410https://access.redhat.com/errata/RHSA-2026:2512https://access.redhat.com/errata/RHSA-2026:2513https://access.redhat.com/errata/RHSA-2026:2514https://access.redhat.com/errata/RHSA-2026:2528https://access.redhat.com/errata/RHSA-2026:2529https://access.redhat.com/errata/RHSA-2026:2628https://access.redhat.com/errata/RHSA-2026:2844https://access.redhat.com/security/cve/CVE-2026-1761https://bugzilla.redhat.com/show_bug.cgi?id=2435961https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1761.json
2026-02-02
Published