# Ubuntu releases libsoup update to fix memory leak regression and multiple CVEs

> **Key takeaway:** Ubuntu has issued a security update for libsoup to resolve a memory leak introduced in a previous patch and to address several critical vulnerabilities including DoS and information disclosure.

**Published:** 2026-11-09T23:12:32+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/ubuntu-releases-libsoup-update-to-fix-memory-leak-regression.html 

## Summary
Canonical has released USN-8890-3 to address a regression in the libsoup library. A previous security update (USN-8890-1) inadvertently introduced a memory leak within the cookie jar component, which necessitated this corrective release.

This update specifically targets users of Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS. The release addresses a wide array of vulnerabilities ranging from denial-of-service risks to potential arbitrary code execution and sensitive information disclosure caused by improper handling of HTTP/2, HTTPS proxies, and chunked HTTP requests.

## Vulnerability and regression details
- **Memory Management:** The update fixes a regression in the libsoup cookie jar that caused a memory leak following the initial security patch.
- **HTTP/2 Protocol Handling:** Multiple CVEs (CVE-2026-4271, CVE-2026-85197, CVE-2026-85534) address improper handling of HTTP/2 connections and transfers, which could lead to denial of service or arbitrary code execution.
- **Proxy and Authentication Security:** The patch mitigates risks involving HTTPS proxy connections (CVE-2026-5119) and proxy authentication credentials (CVE-2026-66339) that could allow attackers to obtain sensitive data.
- **Request Parsing Flaws:** Fixes are included for incorrect parsing of chunked HTTP requests (CVE-2026-6324) and HTTP Range headers (CVE-2026-77014, CVE-2026-77680) to prevent security control bypasses and denial of service.

## Why it matters
Since libsoup is a widely used HTTP client/server library for GNOME and various Linux applications, these fixes are critical for maintaining system stability and preventing remote exploits. System administrators on Ubuntu LTS releases should apply these updates immediately to resolve both the stability issues caused by the memory leak and the high-severity security risks.