Libsoup
Monthly
Heap buffer overflow in libsoup's WebSocket permessage-deflate compression can be triggered when a very large outgoing message is compressed, allowing a remote unauthenticated attacker to cause a denial of service and potentially limited data disclosure or modification. The flaw affects libsoup as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10; the independent assessment rates attack complexity as high because triggering requires a multi-gigabyte-scale message, making casual exploitation unlikely. No public exploit identified at time of analysis.
Heap memory corruption in libsoup can be triggered when a WebSocket client using libsoup constructs a masked outgoing frame for an extremely large payload near the 32-bit guint limit, truncating the GByteArray allocation size while the masking routine processes the full length. It affects libsoup as shipped in Red Hat Enterprise Linux 6 through 10. The assessed CVSS vector is network-reachable but high-complexity (AV:N/AC:H/PR:N/UI:N), and no public exploit identified at time of analysis.
Heap out-of-bounds read in libsoup's WebSocket implementation allows a remote, unauthenticated peer to trigger a heap buffer overflow when the application has configured max-incoming-payload-size to unlimited (0), a non-default setting; with the standard payload cap the overflow cannot be reached. The CVSS 3.1 base score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H), but our assessed vector raises complexity to AC:H because exploitation requires both the non-default unlimited setting and a frame large enough to wrap the GByteArray length counter, implying a very large transfer. No public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds read and application crash in libsoup's soup_uri_decode_data_uri() affect applications that pass attacker-controlled base64 data: URIs to the GLib-based HTTP library, with Red Hat shipping vulnerable packages across Red Hat Enterprise Linux 6, 7, 8, 9 and 10. A crafted data URI whose percent-decoded payload contains embedded NUL bytes causes the decoded length to remain uninitialized and be used as the size of the returned GBytes, yielding a minor confidentiality leak (C:L) alongside a serious availability impact (A:H) rated 8.2 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H. The issue is remotely triggerable without authentication (PR:N) and no public exploit code has been identified at time of analysis, though real-world exposure is limited to software that actually processes untrusted data: URIs (WebKit/GTK browsers, feed and mail readers, and other GNOME applications rendering remote content).
Heap corruption and denial of service in libsoup stem from unbounded WebSocket message reassembly: the code accumulates fragmented frames in a GByteArray without checking the total reassembled size against the buffer type's size limit, so an oversized message can truncate the tracked length while the implementation continues to use the full length, producing out-of-bounds memory access (CWE-125) and possible crashes. The flaw is reachable by unauthenticated remote peers that can establish a WebSocket connection with a libsoup-based server, or by a libsoup client that connects to an attacker-controlled or man-in-the-middle server, but the assessed vector (AC:H) reflects that the attacker must drive reassembly to the underlying ~4 GB buffer-type boundary, so ordinary small-message WebSocket traffic does not trigger it. No public exploit code or CISA KEV active-exploitation confirmation was identified at time of analysis.
A type-confusion memory-safety flaw in libsoup's WebSocket handling can crash or corrupt the heap of applications that process incoming Pong frames. When a Pong frame arrives, SoupWebsocketConnection emits its ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes object, so any application that connects a ::pong handler written to the documented GBytes API will misinterpret the payload and may suffer heap corruption or a crash. This is not exploitable against default libsoup usage: the target must both act as a WebSocket peer and explicitly register a ::pong handler, and the attacker must control or compromise the WebSocket endpoint (or otherwise inject a crafted Pong frame) into that connection. The recorded CVSS 3.1 base score is 8.6, but the independent assessment rates it AC:H with C:L/I:L/A:H because exploitation is gated on that non-default handler registration; unauthenticated remote attackers (PR:N, UI:N) can reach the code path, however no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited.
HTTP request smuggling in libsoup (GNOME's HTTP client/server library) enables network-accessible attackers to inject hidden requests into backend streams by exploiting a parsing differential between libsoup's permissive chunked transfer encoding parser and strict RFC 9112-compliant frontend proxies. All libsoup versions are affected as tracked under CPE cpe:2.3:a:gnome:libsoup, with confirmed vendor impact across Red Hat Enterprise Linux 6.0 through 10.0. No public exploit code or active exploitation has been identified at time of analysis; SSVC classifies exploitation as none with non-automatable, partial technical impact.
HTTP request smuggling in libsoup's SoupServer - as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10 - allows remote, unauthenticated attackers to have an attacker-controlled HTTP request processed as an unintended subsequent request on a keep-alive connection. The issue triggers when an HTTP/1.x client sends 'Expect: 100-continue' with a declared body and the SoupServer-based application issues an early final (non-1xx) response before that body is read; SoupServer then neither drains the body bytes nor closes the connection, so the leftover bytes are parsed as the next request. Rated CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), the flaw carries limited integrity impact on request handling while leaving confidentiality and availability unaffected, and it is inert unless the specific combination of keep-alive, a declared body, and an early final response is present. No public exploit code and no confirmed active exploitation were identified at time of analysis.
libsoup leaks proxy credentials to destination servers via Proxy-Authorization header attachment after CONNECT tunnel establishment. Affects libsoup when used with HTTP proxies for HTTPS tunneling. No public exploit is known, and exploitation probability is low (EPSS 0.23%).
Heap buffer over-read in libsoup's multipart response parser allows remote, unauthenticated attackers to crash client applications or leak heap memory. The flaw occurs when processing crafted HTTP multipart responses from a malicious server. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability.
Heap out-of-bounds read in libsoup's multipart HTTP message parser allows remote attackers to crash affected applications or leak heap memory contents. An integer type mismatch between the calling code and soup_headers_parse() causes the length parameter to be incorrectly truncated, enabling a read beyond the allocated heap buffer boundary. No active exploitation has been identified (no CISA KEV listing, no public POC), and the CVSS score of 4.2 with AC:H/UI:R reflects meaningful real-world friction for successful exploitation.
libsoup versions prior to the patched release contain an integer underflow vulnerability in zero-length resource processing that enables unauthenticated remote attackers to read adjacent memory or trigger denial of service. The vulnerability stems from improper bounds checking during content handling, affecting any application using the vulnerable libsoup library for HTTP operations. No public exploit code has been identified, and the low EPSS score (0.04%, percentile 11%) indicates exploitation is unlikely in practice despite the moderate CVSS score of 6.5.
Libsoup's digest authentication mechanism fails to validate nonce reuse and enforce proper nonce-count incrementation, enabling attackers to replay captured authentication headers to bypass access controls. A remote attacker can exploit this to impersonate legitimate users and access protected resources without valid credentials. No patch is currently available.
libsoup's improper validation of HTTP Range headers enables remote attackers to read sensitive server memory when processing specially crafted requests against vulnerable SoupServer instances. The flaw affects GNOME-based systems using certain build configurations and requires no authentication or user interaction. No patch is currently available, and exploitation likelihood remains low at 0.1% EPSS.
HTTP request smuggling in libsoup allows remote attackers to exploit non-compliant chunk header parsing by injecting malformed requests with LF-only line endings instead of proper CRLF formatting. Without requiring authentication, an attacker can cause libsoup to interpret multiple HTTP requests from a single network message, potentially leading to information disclosure. No patch is currently available for this vulnerability.
libsoup's HTTP redirect handling fails to strip Proxy-Authorization headers when requests are forwarded to different hosts, allowing proxy credentials to be exposed to unintended third-party servers. Applications relying on libsoup for HTTP communication are vulnerable to disclosure of sensitive proxy authentication data. No patch is currently available.
HTTP header injection in libsoup through CRLF sequences in the Content-Disposition header allows unauthenticated remote attackers to inject arbitrary headers or split responses without user interaction. Public exploit code exists for this vulnerability. The flaw affects any application using vulnerable versions of libsoup to process untrusted HTTP headers, with no patch currently available.
libsoup's improper handling of URL-decoded input in HTTP proxy configurations allows remote attackers to inject CRLF sequences into the Host header, enabling injection of arbitrary HTTP headers or request bodies. Public exploit code exists for this vulnerability, which could allow attackers to manipulate downstream services through compromised proxy requests. Affected applications using libsoup with HTTP proxy functionality are at risk of integrity compromise, though no patch is currently available.
A flaw was found in libsoup. Rated high severity (CVSS 7.0), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_parse_param_list_strict. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soup_ntlm_parse_challenge() in soup-auth-ntlm.c does not properly check an NTLM message's length before proceeding. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ prior to version 2.20.0 or without libsoup 2.62.0, unexpectedly failed to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
libsoup 2.32.2 and earlier does not validate certificates or clear the trust flag when the ssl-ca-file does not exist, which allows remote attackers to bypass authentication by connecting with a SSL. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Heap buffer overflow in libsoup's WebSocket permessage-deflate compression can be triggered when a very large outgoing message is compressed, allowing a remote unauthenticated attacker to cause a denial of service and potentially limited data disclosure or modification. The flaw affects libsoup as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10; the independent assessment rates attack complexity as high because triggering requires a multi-gigabyte-scale message, making casual exploitation unlikely. No public exploit identified at time of analysis.
Heap memory corruption in libsoup can be triggered when a WebSocket client using libsoup constructs a masked outgoing frame for an extremely large payload near the 32-bit guint limit, truncating the GByteArray allocation size while the masking routine processes the full length. It affects libsoup as shipped in Red Hat Enterprise Linux 6 through 10. The assessed CVSS vector is network-reachable but high-complexity (AV:N/AC:H/PR:N/UI:N), and no public exploit identified at time of analysis.
Heap out-of-bounds read in libsoup's WebSocket implementation allows a remote, unauthenticated peer to trigger a heap buffer overflow when the application has configured max-incoming-payload-size to unlimited (0), a non-default setting; with the standard payload cap the overflow cannot be reached. The CVSS 3.1 base score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H), but our assessed vector raises complexity to AC:H because exploitation requires both the non-default unlimited setting and a frame large enough to wrap the GByteArray length counter, implying a very large transfer. No public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds read and application crash in libsoup's soup_uri_decode_data_uri() affect applications that pass attacker-controlled base64 data: URIs to the GLib-based HTTP library, with Red Hat shipping vulnerable packages across Red Hat Enterprise Linux 6, 7, 8, 9 and 10. A crafted data URI whose percent-decoded payload contains embedded NUL bytes causes the decoded length to remain uninitialized and be used as the size of the returned GBytes, yielding a minor confidentiality leak (C:L) alongside a serious availability impact (A:H) rated 8.2 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H. The issue is remotely triggerable without authentication (PR:N) and no public exploit code has been identified at time of analysis, though real-world exposure is limited to software that actually processes untrusted data: URIs (WebKit/GTK browsers, feed and mail readers, and other GNOME applications rendering remote content).
Heap corruption and denial of service in libsoup stem from unbounded WebSocket message reassembly: the code accumulates fragmented frames in a GByteArray without checking the total reassembled size against the buffer type's size limit, so an oversized message can truncate the tracked length while the implementation continues to use the full length, producing out-of-bounds memory access (CWE-125) and possible crashes. The flaw is reachable by unauthenticated remote peers that can establish a WebSocket connection with a libsoup-based server, or by a libsoup client that connects to an attacker-controlled or man-in-the-middle server, but the assessed vector (AC:H) reflects that the attacker must drive reassembly to the underlying ~4 GB buffer-type boundary, so ordinary small-message WebSocket traffic does not trigger it. No public exploit code or CISA KEV active-exploitation confirmation was identified at time of analysis.
A type-confusion memory-safety flaw in libsoup's WebSocket handling can crash or corrupt the heap of applications that process incoming Pong frames. When a Pong frame arrives, SoupWebsocketConnection emits its ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes object, so any application that connects a ::pong handler written to the documented GBytes API will misinterpret the payload and may suffer heap corruption or a crash. This is not exploitable against default libsoup usage: the target must both act as a WebSocket peer and explicitly register a ::pong handler, and the attacker must control or compromise the WebSocket endpoint (or otherwise inject a crafted Pong frame) into that connection. The recorded CVSS 3.1 base score is 8.6, but the independent assessment rates it AC:H with C:L/I:L/A:H because exploitation is gated on that non-default handler registration; unauthenticated remote attackers (PR:N, UI:N) can reach the code path, however no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited.
HTTP request smuggling in libsoup (GNOME's HTTP client/server library) enables network-accessible attackers to inject hidden requests into backend streams by exploiting a parsing differential between libsoup's permissive chunked transfer encoding parser and strict RFC 9112-compliant frontend proxies. All libsoup versions are affected as tracked under CPE cpe:2.3:a:gnome:libsoup, with confirmed vendor impact across Red Hat Enterprise Linux 6.0 through 10.0. No public exploit code or active exploitation has been identified at time of analysis; SSVC classifies exploitation as none with non-automatable, partial technical impact.
HTTP request smuggling in libsoup's SoupServer - as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10 - allows remote, unauthenticated attackers to have an attacker-controlled HTTP request processed as an unintended subsequent request on a keep-alive connection. The issue triggers when an HTTP/1.x client sends 'Expect: 100-continue' with a declared body and the SoupServer-based application issues an early final (non-1xx) response before that body is read; SoupServer then neither drains the body bytes nor closes the connection, so the leftover bytes are parsed as the next request. Rated CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), the flaw carries limited integrity impact on request handling while leaving confidentiality and availability unaffected, and it is inert unless the specific combination of keep-alive, a declared body, and an early final response is present. No public exploit code and no confirmed active exploitation were identified at time of analysis.
libsoup leaks proxy credentials to destination servers via Proxy-Authorization header attachment after CONNECT tunnel establishment. Affects libsoup when used with HTTP proxies for HTTPS tunneling. No public exploit is known, and exploitation probability is low (EPSS 0.23%).
Heap buffer over-read in libsoup's multipart response parser allows remote, unauthenticated attackers to crash client applications or leak heap memory. The flaw occurs when processing crafted HTTP multipart responses from a malicious server. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability.
Heap out-of-bounds read in libsoup's multipart HTTP message parser allows remote attackers to crash affected applications or leak heap memory contents. An integer type mismatch between the calling code and soup_headers_parse() causes the length parameter to be incorrectly truncated, enabling a read beyond the allocated heap buffer boundary. No active exploitation has been identified (no CISA KEV listing, no public POC), and the CVSS score of 4.2 with AC:H/UI:R reflects meaningful real-world friction for successful exploitation.
libsoup versions prior to the patched release contain an integer underflow vulnerability in zero-length resource processing that enables unauthenticated remote attackers to read adjacent memory or trigger denial of service. The vulnerability stems from improper bounds checking during content handling, affecting any application using the vulnerable libsoup library for HTTP operations. No public exploit code has been identified, and the low EPSS score (0.04%, percentile 11%) indicates exploitation is unlikely in practice despite the moderate CVSS score of 6.5.
Libsoup's digest authentication mechanism fails to validate nonce reuse and enforce proper nonce-count incrementation, enabling attackers to replay captured authentication headers to bypass access controls. A remote attacker can exploit this to impersonate legitimate users and access protected resources without valid credentials. No patch is currently available.
libsoup's improper validation of HTTP Range headers enables remote attackers to read sensitive server memory when processing specially crafted requests against vulnerable SoupServer instances. The flaw affects GNOME-based systems using certain build configurations and requires no authentication or user interaction. No patch is currently available, and exploitation likelihood remains low at 0.1% EPSS.
HTTP request smuggling in libsoup allows remote attackers to exploit non-compliant chunk header parsing by injecting malformed requests with LF-only line endings instead of proper CRLF formatting. Without requiring authentication, an attacker can cause libsoup to interpret multiple HTTP requests from a single network message, potentially leading to information disclosure. No patch is currently available for this vulnerability.
libsoup's HTTP redirect handling fails to strip Proxy-Authorization headers when requests are forwarded to different hosts, allowing proxy credentials to be exposed to unintended third-party servers. Applications relying on libsoup for HTTP communication are vulnerable to disclosure of sensitive proxy authentication data. No patch is currently available.
HTTP header injection in libsoup through CRLF sequences in the Content-Disposition header allows unauthenticated remote attackers to inject arbitrary headers or split responses without user interaction. Public exploit code exists for this vulnerability. The flaw affects any application using vulnerable versions of libsoup to process untrusted HTTP headers, with no patch currently available.
libsoup's improper handling of URL-decoded input in HTTP proxy configurations allows remote attackers to inject CRLF sequences into the Host header, enabling injection of arbitrary HTTP headers or request bodies. Public exploit code exists for this vulnerability, which could allow attackers to manipulate downstream services through compromised proxy requests. Affected applications using libsoup with HTTP proxy functionality are at risk of integrity compromise, though no patch is currently available.
A flaw was found in libsoup. Rated high severity (CVSS 7.0), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_parse_param_list_strict. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soup_ntlm_parse_challenge() in soup-auth-ntlm.c does not properly check an NTLM message's length before proceeding. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ prior to version 2.20.0 or without libsoup 2.62.0, unexpectedly failed to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
libsoup 2.32.2 and earlier does not validate certificates or clear the trust flag when the ssl-ca-file does not exist, which allows remote attackers to bypass authentication by connecting with a SSL. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.