libsoup CVE-2026-15714

The target application must use libsoup to perform HTTP requests and process multipart HTTP responses - applications that never consume multipart content are not affected by this code path. The attacker must control or influence the HTTP server from which the libsoup-consuming application fetches content, either by operating a malicious server the application contacts, performing a man-in-the-middle intercept, or poisoning a DNS/redirect path. Exploitation is rated automatable (SSVC), and the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no user interaction, and low attack complexity are required on the attacker side. Limiting factors include: the victim application must initiate an outbound HTTP request to attacker-influenced infrastructure, and the impact is partial (DoS or memory metadata leak, not arbitrary code execution). Applications running libsoup in isolated network environments or behind egress filtering that prevents connections to untrusted hosts are significantly less exposed.

The CVSS 3.1 base score of 6.5 (Medium) reflects a network-reachable, unauthenticated, low-complexity attack with partial confidentiality and availability impact and no integrity impact. The EPSS score of 0.39% (31st percentile) is notably low, suggesting the broader exploitation community has not widely operationalized this flaw at time of analysis - this is a meaningful downward signal relative to the CVSS score alone. However, SSVC assessment counters with exploitation status of 'poc' (a working proof-of-concept exists) and 'automatable: yes', indicating that mass exploitation infrastructure could be built. Technical impact is rated 'partial', consistent with CVSS C:L/A:L and no full system compromise path. Synthesizing these signals: CVSS overstates urgency relative to EPSS, but the automatable POC is a genuine escalation risk. The realistic threat is a denial-of-service against libsoup-consuming applications (e.g., GNOME desktop fetch operations, server-side apps using libsoup) rather than a full remote code execution chain. There is no KEV listing confirming active exploitation at time of analysis. No conflicting signal between CVSS attack vector (Network) and description - the HTTP response processing context is fully consistent with AV:N.

An attacker operates a malicious HTTP server and entices or forces a target application built on libsoup to fetch a resource from it - for example, via a crafted redirect, a DNS poisoning attack, or by hosting content that a scheduled job retrieves. The malicious server returns an HTTP response with a Content-Type multipart boundary parameter containing an oversized or specially crafted string. When soup_multipart_input_stream_read_headers() processes this response, it reads past the end of the allocated boundary buffer, either crashing the application (DoS) or exposing adjacent memory metadata. A proof-of-concept exists per SSVC data, lowering the barrier for exploitation.