libsoup CVE-2026-77680

Exploitation requires three concurrent conditions: (1) the target application uses libsoup's SoupServer API - libsoup client-only deployments are not in the vulnerable code path; (2) a SoupServer handler returns HTTP 200 with a non-empty body, which is the standard success response pattern and not a special configuration; and (3) the installed libsoup version contains the CVE-2025-32907 fix (commit 9bb92f7a) but not MR !550. No authentication is required - the CVSS vector PR:N confirms unauthenticated exploitation. The primary limiting factor is that only applications actively running SoupServer are affected; the impact per request is also bounded at approximately 90 ms of event-loop blockage, which is disruptive under a sustained stream but does not constitute instantaneous complete outage from a single packet.

The CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) correctly characterises a network-reachable, unauthenticated, zero-complexity denial-of-service with limited per-request impact. The ~90 ms event-loop blockage per crafted request is modest individually but compounds under sustained load: a low-rate stream of such requests from a single client could render a SoupServer instance non-responsive without triggering volumetric rate limits. No CISA KEV listing exists and no public exploit code has been identified, lowering near-term exploitation probability; however, the attack primitive requires only a standard HTTP client and is trivially reproducible with curl or any HTTP library, so the practical barrier is very low despite the absence of a published PoC. SSVC signals suggest a 'Track' or 'Attend' posture: exploitation is not confirmed active, the technique is trivially automatable, and technical impact is partial availability. Importantly, the intelligence metadata tags 'Buffer Overflow' and 'Information Disclosure' conflict directly with the CVE description, which explicitly rules out memory corruption and information disclosure - those tags must be treated as erroneous and disregarded when assessing actual impact or scope.

An unauthenticated attacker sends a single HTTP GET request to any endpoint served by a SoupServer instance with a Range header containing approximately 25,000 repetitions of 'bytes=0-0'. The server's handle_partial_get() function invokes the vulnerable O(N²) coalescing loop, consuming roughly 90 ms of CPU on a single core and blocking the event loop for that duration; repeating this at a sustained rate across concurrent connections can render the server unresponsive to legitimate traffic. No public exploit code has been identified, but the attack requires only a standard HTTP client.