What is the CVSS score of CVE-2026-2369?

CVE-2026-2369 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Libsoup are affected by CVE-2026-2369?

Organizations using A flaw should be aware of notable risk from CVE-2026-2369 rated CVSS 6.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-2369?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Libsoup CVE-2026-2369

MEDIUM

Integer Underflow (CWE-191)

2026-03-19 secalert@redhat.com

Denial Of Service Integer Overflow Libsoup

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Patch released

Apr 09, 2026 - 20:30 nvd

Patch available

Analysis Generated

Mar 20, 2026 - 13:52 vuln.today

CVE Published

Mar 19, 2026 - 15:16 nvd

MEDIUM 6.5

DescriptionCVE.org

A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This can allow an attacker to potentially access sensitive information or cause an application level denial of service.

AnalysisAI

libsoup versions prior to the patched release contain an integer underflow vulnerability in zero-length resource processing that enables unauthenticated remote attackers to read adjacent memory or trigger denial of service. The vulnerability stems from improper bounds checking during content handling, affecting any application using the vulnerable libsoup library for HTTP operations. No public exploit code has been identified, and the low EPSS score (0.04%, percentile 11%) indicates exploitation is unlikely in practice despite the moderate CVSS score of 6.5.

Technical ContextAI

libsoup is a GNOME HTTP client/server library used for HTTP protocol handling in numerous desktop and server applications. The vulnerability is rooted in CWE-191 (Integer Underflow or Wraparound), a class of arithmetic errors where integer values wrap to extremely large values when decremented below zero. When libsoup processes HTTP responses with zero-length resources, improper subtraction or size calculation causes an integer underflow, resulting in a massively inflated buffer size that permits reading beyond allocated memory boundaries. This class of vulnerability is distinct from traditional buffer overflows-the attacker does not inject data, but rather causes the application to read unintended memory regions due to incorrect arithmetic. The affected component processes HTTP entity bodies and metadata, meaning any libsoup-based HTTP client or server can be exploited remotely without authentication (PR:N per CVSS vector).

RemediationAI

Update libsoup to the patched version released by the GNOME project and distributed through your operating system's package manager. For Red Hat distributions, apply the security advisory available at https://access.redhat.com/security/cve/CVE-2026-2369. For Debian/Ubuntu systems, check the security advisories from your distribution vendor. Verify the exact patched version by consulting the vendor advisory; apply the update to all systems running libsoup-dependent applications (GNOME components, Evolution, and related tools). Until patching is possible, restrict HTTP traffic to trusted, authenticated peers where feasible, and disable HTTP client functionality in libsoup-based applications if not required for normal operation. Monitor for unexplained crashes or memory access errors in libsoup-based services, which may indicate exploitation attempts.

More in Libsoup

View all

CVE-2019-17266 CRITICAL Act Now POC

9.8 Oct 06

libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soup_ntlm_parse_challenge() in soup

CVE-2024-52530 HIGH This Week POC

7.5 Nov 11

GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of he

CVE-2025-2784 MEDIUM This Month POC

6.5 Apr 03

A flaw was found in libsoup. Rated high severity (CVSS 7.0), this vulnerability is remotely exploitable, no authenticati

CVE-2024-52531 MEDIUM This Month POC

6.5 Nov 11

GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_pars

CVE-2018-12910 CRITICAL Act Now

9.8 Jul 05

The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty

CVE-2024-52532 HIGH This Week

7.5 Nov 11

GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. Rated high severity (CVSS 7.5), this vulnerabil

CVE-2026-66338 HIGH This Week

7.2 Jul 24

HTTP request smuggling in libsoup (GNOME's HTTP client/server library) enables network-accessible attackers to inject hi

CVE-2026-66339 MEDIUM This Month

6.5 Jul 24

libsoup leaks proxy credentials to destination servers via Proxy-Authorization header attachment after CONNECT tunnel es

CVE-2026-66337 MEDIUM This Month

6.5 Jul 24

Heap buffer over-read in libsoup's multipart response parser allows remote, unauthenticated attackers to crash client ap

CVE-2018-11713 MEDIUM This Month

6.5 Jun 04

WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKit

CVE-2012-2132 MEDIUM This Month

5.0 Aug 20

libsoup 2.32.2 and earlier does not validate certificates or clear the trust flag when the ssl-ca-file does not exist, w

CVE-2026-12548 MEDIUM This Month

4.2 Jul 21

Heap out-of-bounds read in libsoup's multipart HTTP message parser allows remote attackers to crash affected application

Same weakness CWE-191 – Integer Underflow

View all

CVE-2014-0497 CRITICAL POC

9.8

CVE-2015-5212 MEDIUM

6.8

CVE-2017-14496 HIGH POC

7.5

CVE-2014-8768 MEDIUM POC

5.0

CVE-2017-11757 CRITICAL POC

9.8

CVE-2024-23313 CRITICAL POC

9.8

CVE-2021-3323 CRITICAL POC

9.8

CVE-2021-21811 CRITICAL POC

9.8

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.53 Container suse/sl-micro/6.0/toolbox:13.2-9.12	Affected
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production	Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Fixed

CVE-2026-2369 vulnerability details – vuln.today

Back

Libsoup CVE-2026-2369

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Libsoup

Same weakness CWE-191 – Integer Underflow

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code