libsoup EUVD-2026-63225

Exploitation requires the target to run a SoupServer-based application that serves files or resources exceeding approximately 2 GB over HTTP, and the attacker must craft an HTTP Range request with at least two range offsets whose difference exceeds INT_MAX (~2,147,483,647 bytes). Per the CVSS vector (PR:N), no authentication is required. The flaw is limited to libsoup's server-side Range processing: applications using libsoup solely as an HTTP client are not affected. Non-default conditions that limit exploitation include: the served resource must be larger than ~2 GB (not a typical web application asset), and the client must use multi-range or large-offset Range requests. The impact is confined to silent data omission in 206 responses - no code execution, memory disclosure, or denial of service is possible.

The CVSS 5.3 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately characterizes this as a medium-severity integrity flaw: network-reachable, requiring no authentication or user interaction, but limited to a partial integrity impact with no confidentiality or availability consequence. EPSS data was not provided in the source intelligence, so exploitation probability cannot be quantified. Neither a CISA KEV listing nor public proof-of-concept code has been identified, suggesting this is not currently being actively leveraged in the wild. The practical real-world risk is bounded by two constraints: the target application must use SoupServer to serve files exceeding ~2 GB, and the attacker must craft Range headers with offsets spanning more than INT_MAX bytes - conditions that narrow the exploitable population significantly. The silent nature of the data omission (no HTTP error returned) is the most operationally concerning aspect, as downstream clients or pipeline stages may consume incomplete data without detecting corruption. For deployments in content-delivery or large-file-transfer roles built on RHEL and libsoup, this warrants patching on a normal patch-cycle cadence rather than emergency response.

An unauthenticated remote attacker sends an HTTP GET request with a Range header specifying two or more byte ranges whose offsets differ by more than INT_MAX against a SoupServer endpoint serving a resource larger than approximately 2 GB. The truncated comparator inverts sort order for those ranges, and the server silently returns a 206 Partial Content response omitting the affected ranges. A downstream client or automated pipeline consumes the incomplete response without detecting the corruption, producing data-integrity failures in file-transfer or streaming workflows. No public POC exists at time of analysis, but the flaw is mechanically straightforward to trigger with a crafted HTTP request.