CVE-2026-66337
published 2026-07-24CVE-2026-66337: A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing…
PriorityP334medium6.5CVSS 3.1
AVNACLPRNUINSUCLINAL
EPSS
0.25%
14.8th percentile
A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libsoup3 | — | — |
| gnome | libsoup | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
vendor_redhat8.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in libsoup.
ghsa_unreviewed·2026-07-25
CVE-2026-66337 [MEDIUM] CWE-125 A flaw was found in libsoup.
A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory.
VulDB
Red Hat Enterprise Linux libsoup soup_filter_input_stream_read_until integer underflow (EUVD-2026-48753)
vuldb·2026-07-25·CVSS 6.5
CVE-2026-66337 [MEDIUM] Red Hat Enterprise Linux libsoup soup_filter_input_stream_read_until integer underflow (EUVD-2026-48753)
A vulnerability has been found in Red Hat Enterprise Linux and classified as critical. This impacts the function soup_filter_input_stream_read_until of the component libsoup. This manipulation causes integer underflow.
The identification of this vulnerability is CVE-2026-66337. It is possible to initiate the attack remotely. There is no exploit available.
Red Hat
libsoup: libsoup: Heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()
vendor_redhat·2026-06-05·CVSS 8.6
CVE-2026-66337 [HIGH] CWE-125 libsoup: libsoup: Heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()
libsoup: libsoup: Heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()
A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory.
Statement: A flaw was found in libsoup where an unsigned integer underflow in soup_filter_input_stream_read_until() causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can trigger this against any libsoup client using SoupMultipartInputStream by sending a crafted multipart response with a boundary st
No detection rules found.
No public exploits indexed.
2026-07-24
Published