libsoup CVE-2026-12549

Exploitation requires that the target application uses libsoup as its HTTP server library and exposes an HTTP endpoint that processes Range requests from untrusted clients. The attacker must issue a suffix-range request (Range: bytes=-N) where N exceeds the byte length of the requested resource, which is trivially achieved using an arbitrarily large N value. Per the CVSS PR:N vector, no authentication is required. The AC:H rating reflects the content-size dependency, not a meaningful authentication or privilege barrier. Exploitation is limited to HTTP servers built on libsoup; applications that do not serve static or range-capable content, that sit behind a reverse proxy stripping or normalizing Range headers, or that are bound only to trusted internal networks face substantially reduced exposure. End-of-life RHEL 6 systems that cannot receive updated packages but remain network-accessible represent an elevated long-term risk.

The CVSS 3.1 score of 4.8 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L positions this as a moderate, remotely triggerable flaw requiring no authentication. The AC:H designation reflects the content-size dependency - the attacker's suffix value must exceed the specific resource size - but this is a trivially achievable condition by using an arbitrarily large suffix value, making AC:H somewhat optimistic as a real-world barrier. Confidentiality impact is Low (malformed 206 responses could expose partial or garbled content), and Availability is Low (log flooding can exhaust disk). No EPSS data was available in the provided intelligence; the absence of a KEV listing and no identified POC suggest this has not been publicly weaponized. The primary realistic risk is automated log-flooding denial-of-service against services that process untrusted Range requests, rather than data exfiltration. The regression nature of this flaw - a previously patched vulnerability reintroduced by a code rework - warrants elevated concern for patch quality control: organizations that patched CVE-2026-2443 may believe they are protected when they are not.

A remote unauthenticated attacker sends a series of HTTP GET requests to a libsoup-based server with headers such as Range: bytes=-9999999999 targeting any static resource. The server computes a deeply negative start offset due to the regressed signed comparison, emits malformed HTTP 206 responses, and generates a high-volume error log entry per request. Automated scripted requests at moderate rates can exhaust available disk space through log flooding, degrading or halting the service. No public POC has been identified at time of analysis.