Skip to main content

Libsoup CVE-2026-2369

MEDIUM
Integer Underflow (CWE-191)
2026-03-19 secalert@redhat.com
Denial Of Service Integer Overflow Libsoup
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
SUSE
MEDIUM
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
Low

Lifecycle Timeline

3
Patch released
Apr 09, 2026 - 20:30 nvd
Patch available
Analysis Generated
Mar 20, 2026 - 13:52 vuln.today
CVE Published
Mar 19, 2026 - 15:16 nvd
MEDIUM 6.5

DescriptionCVE.org

A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This can allow an attacker to potentially access sensitive information or cause an application level denial of service.

AnalysisAI

libsoup versions prior to the patched release contain an integer underflow vulnerability in zero-length resource processing that enables unauthenticated remote attackers to read adjacent memory or trigger denial of service. The vulnerability stems from improper bounds checking during content handling, affecting any application using the vulnerable libsoup library for HTTP operations. No public exploit code has been identified, and the low EPSS score (0.04%, percentile 11%) indicates exploitation is unlikely in practice despite the moderate CVSS score of 6.5.

Technical ContextAI

libsoup is a GNOME HTTP client/server library used for HTTP protocol handling in numerous desktop and server applications. The vulnerability is rooted in CWE-191 (Integer Underflow or Wraparound), a class of arithmetic errors where integer values wrap to extremely large values when decremented below zero. When libsoup processes HTTP responses with zero-length resources, improper subtraction or size calculation causes an integer underflow, resulting in a massively inflated buffer size that permits reading beyond allocated memory boundaries. This class of vulnerability is distinct from traditional buffer overflows-the attacker does not inject data, but rather causes the application to read unintended memory regions due to incorrect arithmetic. The affected component processes HTTP entity bodies and metadata, meaning any libsoup-based HTTP client or server can be exploited remotely without authentication (PR:N per CVSS vector).

RemediationAI

Update libsoup to the patched version released by the GNOME project and distributed through your operating system's package manager. For Red Hat distributions, apply the security advisory available at https://access.redhat.com/security/cve/CVE-2026-2369. For Debian/Ubuntu systems, check the security advisories from your distribution vendor. Verify the exact patched version by consulting the vendor advisory; apply the update to all systems running libsoup-dependent applications (GNOME components, Evolution, and related tools). Until patching is possible, restrict HTTP traffic to trusted, authenticated peers where feasible, and disable HTTP client functionality in libsoup-based applications if not required for normal operation. Monitor for unexplained crashes or memory access errors in libsoup-based services, which may indicate exploitation attempts.

More in Libsoup

View all
CVE-2019-17266 CRITICAL POC
9.8 Oct 06

libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soup_ntlm_parse_challenge() in soup
CVE-2024-52530 HIGH POC
7.5 Nov 11

GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of he
CVE-2025-2784 MEDIUM POC
6.5 Apr 03

A flaw was found in libsoup. Rated high severity (CVSS 7.0), this vulnerability is remotely exploitable, no authenticati
CVE-2024-52531 MEDIUM POC
6.5 Nov 11

GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_pars
CVE-2018-12910 CRITICAL
9.8 Jul 05

The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty
CVE-2024-52532 HIGH
7.5 Nov 11

GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. Rated high severity (CVSS 7.5), this vulnerabil
CVE-2018-11713 MEDIUM
6.5 Jun 04

WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKit
CVE-2012-2132 MEDIUM
5.0 Aug 20

libsoup 2.32.2 and earlier does not validate certificates or clear the trust flag when the ssl-ca-file does not exist, w

Same weakness CWE-191 – Integer Underflow

View all
CVE-2014-0497 CRITICAL POC
9.8
CVE-2015-5212 MEDIUM
6.8
CVE-2017-14496 HIGH POC
7.5
CVE-2014-8768 MEDIUM POC
5.0
CVE-2017-11757 CRITICAL POC
9.8
CVE-2024-23313 CRITICAL POC
9.8
CVE-2021-3323 CRITICAL POC
9.8
CVE-2021-21811 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.53 Container suse/sl-micro/6.0/toolbox:13.2-9.12 Affected
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed

Share

CVE-2026-2369 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy