Debian Libsoup3 vulnerabilities

CVE-2026-6324 [MEDIUM] CWE-444 libsoup: libsoup: HTTP Request Smuggling via Unsigned to Signed Conversion Error libsoup: libsoup: HTTP Request Smuggling via Unsigned to Signed Conversion Error A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the `soup_body_input_stream_read_chunked()` function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non

CVE-2026-0719 [HIGH] CVE-2026-0719: libsoup2.4 - A flaw was identified in the NTLM authentication handling of the libsoup HTTP li... A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication. When processing extremely long passwords, an internal size calculation can overflow due to improper use of signed integers. This results in incorrect memory allocation on the stack, followed by unsafe memory copying.

CVE-2026-1761 [HIGH] CVE-2026-1761: libsoup2.4 - A flaw was found in libsoup. This stack-based buffer overflow vulnerability occu... A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by sending a specially crafted multipart HTTP response, which can lead to memory corruption. This issue may result in application crashes or arbitrary code execut

CVE-2026-2369 [MEDIUM] CVE-2026-2369: libsoup2.4 - A flaw was found in libsoup. An integer underflow vulnerability occurs when proc... A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This can allow an attacker to potentially access sensitive information or cause an application level denial of service. Scope: local bookworm: open bullseye: open trixie: open

CVE-2026-2436 [MEDIUM] CVE-2026-2436: libsoup2.4 - A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-... A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a

CVE-2026-0716 [MEDIUM] CVE-2026-0716: libsoup2.4 - A flaw was found in libsoup’s WebSocket frame processing when handling incoming ... A flaw was found in libsoup’s WebSocket frame processing when handling incoming messages. If a non-default configuration is used where the maximum incoming payload size is unset, the library may read memory outside the intended bounds. This can cause unintended memory exposure or a crash. Applications using libsoup’s WebSocket support with this configuration may

CVE-2026-2443 [MEDIUM] CVE-2026-2443: libsoup2.4 - A flaw was identified in libsoup, a widely used HTTP library in GNOME-based syst... A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access portions of server memory beyond the intended response. Exploitation requires a vulnerabl

CVE-2026-1467 [MEDIUM] CVE-2026-1467: libsoup2.4 - A flaw was found in libsoup, an HTTP client library. This vulnerability, known a... A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF (Carriage Return Line Feed) Injection, occurs when an HTTP proxy is configured and the library improperly handles URL-decoded input used to create the Host header. A remote attacker can exploit this by providing a specially crafted URL containing CRLF sequences, allowing them t

CVE-2026-1536 [MEDIUM] CVE-2026-1536: libsoup2.4 - A flaw was found in libsoup. An attacker who can control the input for the Conte... A flaw was found in libsoup. An attacker who can control the input for the Content-Disposition header can inject CRLF (Carriage Return Line Feed) sequences into the header value. These sequences are then interpreted verbatim when the HTTP request or response is constructed, allowing arbitrary HTTP headers to be injected. This vulnerability can lead to HTTP header

CVE-2026-1760 [MEDIUM] CVE-2026-1760: libsoup2.4 - A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs... A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine Transfer-Encoding: chunked and Connection: keep-alive headers. A remote, unauthenticated client can exploit this by sending specially crafted requests, causing SoupServer to fail to close the connection as required by RFC 91

CVE-2026-1801 [MEDIUM] CVE-2026-1801: libsoup2.4 - A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Sm... A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can expl

CVE-2026-5119 [MEDIUM] CVE-2026-5119: libsoup2.4 - A flaw was found in libsoup. When establishing HTTPS tunnels through a configure... A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation. Scope: local bookworm: open

CVE-2026-1539 [MEDIUM] CVE-2026-1539: libsoup2.4 - A flaw was found in the libsoup HTTP library that can cause proxy authentication... A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTTP redirects, libsoup removes the Authorization header but does not remove the Proxy-Authorization header if the request is redirected to a different host. As a result, sensitive proxy credentials may be leaked to thi

CVE-2026-4271 [MEDIUM] CVE-2026-4271: libsoup2.4 - A flaw was found in libsoup, a library for handling HTTP requests. This vulnerab... A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by sending specially crafted HTTP/2 requests that cause authentication failures. This can lead to the application attempting to access memory that has already been freed, p

CVE-2026-3099 [MEDIUM] CVE-2026-3099: libsoup2.4 - A flaw was found in Libsoup. The server-side digest authentication implementatio... A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker c

CVE-2026-3632 [LOW] CVE-2026-3632: libsoup2.4 - A flaw was found in libsoup, a library used by applications to send network requ... A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not properly validate hostnames, allowing special characters to be injected into HTTP headers. A remote attacker could exploit this to perform HTTP smuggling, where they can send hidden, malicious requests alongside legitimate ones. In

CVE-2026-3634 [LOW] CVE-2026-3634: libsoup2.4 - A flaw was found in libsoup. An attacker controlling the value used to set the C... A flaw was found in libsoup. An attacker controlling the value used to set the Content-Type header can inject a Carriage Return Line Feed (CRLF) sequence due to improper input sanitization in the `soup_message_headers_set_content_type()` function. This vulnerability allows for the injection of arbitrary header-value pairs, potentially leading to HTTP header injectio

CVE-2026-3633 [LOW] CVE-2026-3633: libsoup2.4 - A flaw was found in libsoup. A remote attacker, by controlling the method parame... A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to

CVE-2025-32911 [CRITICAL] CVE-2025-32911: libsoup2.4 - A use-after-free type vulnerability was found in libsoup, in the soup_message_he... A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server. Scope: local bookworm: open bullseye: resolved (fixed in 2.72.0-2+deb11u2) trixie: resolved (fixed in 2.74.3-10.1)

CVE-2025-2784 [HIGH] CVE-2025-2784: libsoup2.4 - A flaw was found in libsoup. The package is vulnerable to a heap buffer over-rea... A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server. Scope: local bookworm: open bullseye: resolved (fixed in 2.72.0-2+deb11u2) trixie: resolved (fixed in 2.74.3-10)