# Ubuntu 26.10 gets libsoup3 security fixes for seven CVEs

> **Key takeaway:** Ubuntu 26.10 receives libsoup3 updates addressing seven vulnerabilities previously fixed for older libsoup versions in USN-8890-1.

**Published:** 2026-10-21T21:36:06+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/ubuntu-2610-gets-libsoup3-security-fixes-for-seven-cves.html 

## Summary
Ubuntu has issued USN-8890-2 to backport security fixes to libsoup3 on Ubuntu 26.10. The update addresses seven CVEs covering HTTP/2 request handling, HTTPS proxy connections, chunked HTTP parsing, proxy authentication credentials, HTTP Range headers, and HTTP/2 connection management. Several flaws allow remote denial of service, information disclosure, or in one case arbitrary code execution. Most vulnerabilities only affected LTS releases (22.04, 24.04, 26.04), but the proxy authentication credential leak (CVE-2026-66339) and two Range header DoS issues (CVE-2026-77014, CVE-2026-77680) applied to all supported releases.

## Vulnerabilities fixed in libsoup3
- **CVE-2026-4271**: HTTP/2 request handling flaw causing DoS; affected Ubuntu 24.04 LTS and 26.04 LTS
- **CVE-2026-5119**: HTTPS proxy connection handling leading to information disclosure; affected 22.04, 24.04, and 26.04 LTS
- **CVE-2026-6324**: Chunked HTTP request parsing error allowing security control bypass; affected 22.04, 24.04, and 26.04 LTS
- **CVE-2026-66339**: Proxy authentication credential mishandling enabling information disclosure; affected all releases
- **CVE-2026-77014, CVE-2026-77680**: HTTP Range header handling causing DoS; affected all releases
- **CVE-2026-85197**: HTTP/2 connection flaw permitting information disclosure or arbitrary code execution; affected 22.04, 24.04, and 26.04 LTS
- **CVE-2026-85534**: HTTP/2 transfer handling causing DoS; affected 22.04, 24.04, and 26.04 LTS
- Fixed package version for Ubuntu 26.10: **libsoup3 3.6.6-1ubuntu3**

## Why it matters
libsoup is the HTTP client/server library underlying GNOME applications and many GTK-based tools. The arbitrary code execution potential in CVE-2026-85197 makes this a high-priority update for desktop users and applications relying on libsoup3 for network operations.