Skip to main content

libsoup CVE-2026-12549

| EUVDEUVD-2026-38279 MEDIUM
Buffer Access with Incorrect Length Value (CWE-805)
2026-06-22 redhat GHSA-7gwx-vgp2-4hmg
Buffer Overflow Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat
4.8
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
4.8 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
vuln.today AI
4.8 MEDIUM

Network-triggerable via crafted Range header with no authentication; AC:H reflects content-size dependency; impact limited to malformed responses and log flooding with no integrity effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
4.8 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
Low

Lifecycle Timeline

2
Analysis Generated
Jun 22, 2026 - 16:06 vuln.today
CVE Published
Jun 22, 2026 - 13:55 cve.org
MEDIUM 4.8

DescriptionCVE.org

The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding.

AnalysisAI

Malformed HTTP Range request handling in libsoup (GNOME's HTTP client/server library, packaged across Red Hat Enterprise Linux 6-10) re-introduces a signed integer underflow originally patched in CVE-2026-2443. A rework commit replaced specific overflow guards with a general signed comparison, meaning a suffix-byte Range request whose length exceeds the resource content size now produces a negative start offset that is passed unclamped to buffer operations, generating malformed HTTP 206 responses and log flooding. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the unauthenticated network vector makes any exposed libsoup HTTP server reachable without credentials.

Technical ContextAI

libsoup is GNOME's HTTP client/server library, widely embedded in Linux desktop and server applications and distributed as a system package across Red Hat Enterprise Linux releases 6 through 10 (CPEs: cpe:2.3:a:red_hat:red_hat_enterprise_linux_{6,7,8,9,10}). HTTP suffix-range requests use the form Range: bytes=-N, meaning 'deliver the last N bytes'; the server computes start = content_length - N. The root cause is CWE-805 (Buffer Access with Incorrect Length Value): the rework commit that regressed the CVE-2026-2443 fix substituted a specific unsigned overflow check with a general signed integer comparison. When N > content_length, the arithmetic produces a negative start value. Because the downstream buffer logic expects a non-negative offset, the negative value is used as-is, causing out-of-range reads that corrupt the 206 Partial Content response and emit error log entries at high volume. The upstream issue is tracked at https://gitlab.gnome.org/GNOME/libsoup/-/work_items/516.

RemediationAI

Monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-12549 and Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2489999 for errata packages across RHEL 6-10; apply vendor-released updates as soon as they become available. No exact patched libsoup version has been independently confirmed at time of analysis - the upstream fix is tracked as a work item at https://gitlab.gnome.org/GNOME/libsoup/-/work_items/516 rather than a tagged release. As a compensating control, placing libsoup-based HTTP servers behind a reverse proxy (e.g., nginx or HAProxy) configured to reject or normalize Range headers with suffix values exceeding a defined threshold prevents malformed requests from reaching the vulnerable library; note this may break legitimate partial-content delivery for clients that rely on Range support. If the application does not require Range request handling, disabling that feature in the libsoup server configuration entirely eliminates the attack surface with no functional trade-off for most use cases. Rate-limiting Range requests at the network perimeter reduces log-flooding risk but does not eliminate the malformed-response exposure. Administrators should also validate that the original CVE-2026-2443 fix remains intact after applying any patches, given the regression context.

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

Same weakness CWE-805 – Buffer Access with Incorrect Length Value

View all
CVE-2024-24851 HIGH POC
7.5
CVE-2020-14509 CRITICAL
9.8
CVE-2021-3581 HIGH
8.8
CVE-2025-30651 HIGH
8.7
CVE-2026-1837 HIGH
8.7
CVE-2026-1767 HIGH
8.1
CVE-2026-53016 HIGH
7.8
CVE-2025-20175 HIGH
7.7

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected

Share

CVE-2026-12549 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy