Skip to main content

libsoup CVE-2026-12548

| EUVDEUVD-2026-46363 MEDIUM
Out-of-bounds Read (CWE-125)
2026-07-21 secalert@redhat.com GHSA-wmh6-vpqv-v8q3
Information Disclosure Buffer Overflow Libsoup Enterprise Linux
4.2
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
4.2 MEDIUM
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L
vuln.today AI
4.2 MEDIUM

Network vector with high complexity matches targeted multipart crafting; UI:R required as victim application must fetch malicious content; no integrity impact from a read-only over-read.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L
4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
4.8 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Red Hat
4.2 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
Low

Lifecycle Timeline

1
Analysis Generated
Jul 21, 2026 - 19:30 vuln.today

DescriptionCVE.org

A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.

AnalysisAI

Heap out-of-bounds read in libsoup's multipart HTTP message parser allows remote attackers to crash affected applications or leak heap memory contents. An integer type mismatch between the calling code and soup_headers_parse() causes the length parameter to be incorrectly truncated, enabling a read beyond the allocated heap buffer boundary. No active exploitation has been identified (no CISA KEV listing, no public POC), and the CVSS score of 4.2 with AC:H/UI:R reflects meaningful real-world friction for successful exploitation.

Technical ContextAI

libsoup is GNOME's HTTP client/server library (libsoup-3.0 / libsoup-2.4), widely used by GNOME applications and other Linux/GTK-based software to perform HTTP operations. The vulnerability resides in the multipart message parsing path: when soup_headers_parse() is called, an integer type mismatch between the caller-supplied length value and the type expected by the function causes implicit narrowing or sign conversion, truncating the effective length. This causes the parser to read beyond the actual heap-allocated buffer (CWE-125: Out-of-bounds Read). The root cause class - integer type mismatch leading to buffer over-read - is a classic C/C++ hazard where differing signedness or width between caller and callee silently produces wrong arithmetic. The GNOME GitLab work item (gitlab.gnome.org/GNOME/libsoup/-/work_items/512) and Red Hat Bugzilla (BZ#2489996) are the primary upstream tracking references.

RemediationAI

The primary fix should be obtained from the upstream libsoup project tracked at https://gitlab.gnome.org/GNOME/libsoup/-/work_items/512 and from distribution-level patches coordinated by Red Hat (https://access.redhat.com/security/cve/CVE-2026-12548, BZ#2489996). An exact patched version number is not confirmed from the available input data - the upstream fix is available per the GNOME work item but a formally tagged release version was not provided; this should be verified before deployment. Distribution users (RHEL, Fedora, Debian, Ubuntu) should apply OS-level updates as they become available through official package channels. As a compensating control where patching is not immediately possible, applications that consume multipart HTTP content from untrusted sources could be configured to disable or sandbox multipart parsing, though this may break legitimate functionality. Filtering or rejecting multipart Content-Type responses at a network proxy layer would reduce exposure for client applications without code changes.

More in Libsoup

View all
CVE-2019-17266 CRITICAL POC
9.8 Oct 06

libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soup_ntlm_parse_challenge() in soup
CVE-2024-52530 HIGH POC
7.5 Nov 11

GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of he
CVE-2025-2784 MEDIUM POC
6.5 Apr 03

A flaw was found in libsoup. Rated high severity (CVSS 7.0), this vulnerability is remotely exploitable, no authenticati
CVE-2024-52531 MEDIUM POC
6.5 Nov 11

GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_pars
CVE-2018-12910 CRITICAL
9.8 Jul 05

The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty
CVE-2024-52532 HIGH
7.5 Nov 11

GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. Rated high severity (CVSS 7.5), this vulnerabil
CVE-2026-66338 HIGH
7.2 Jul 24

HTTP request smuggling in libsoup (GNOME's HTTP client/server library) enables network-accessible attackers to inject hi
CVE-2026-66339 MEDIUM
6.5 Jul 24

libsoup leaks proxy credentials to destination servers via Proxy-Authorization header attachment after CONNECT tunnel es
CVE-2026-66337 MEDIUM
6.5 Jul 24

Heap buffer over-read in libsoup's multipart response parser allows remote, unauthenticated attackers to crash client ap
CVE-2026-2369 MEDIUM
6.5 Mar 19

libsoup versions prior to the patched release contain an integer underflow vulnerability in zero-length resource process
CVE-2018-11713 MEDIUM
6.5 Jun 04

WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKit
CVE-2012-2132 MEDIUM
5.0 Aug 20

libsoup 2.32.2 and earlier does not validate certificates or clear the trust flag when the ssl-ca-file does not exist, w

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected

Share

CVE-2026-12548 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy