Ubuntu releases libsoup3 updates to address multiple vulnerabilities
Key Takeaway
Multiple vulnerabilities in the libsoup HTTP library could lead to denial of service, information disclosure, or arbitrary code execution.
Summary
Ubuntu has released security updates for libsoup3 on Ubuntu 26.10 to address several vulnerabilities. These flaws involve incorrect handling of HTTP/2 requests, HTTPS proxy connections, and chunked HTTP requests, potentially allowing remote attackers to cause denial of service or steal sensitive data.
Vulnerabilities in libsoup3
- CVE-2026-85197: Incorrect HTTP/2 connection handling could lead to sensitive information disclosure or arbitrary code execution.
- CVE-2026-4271 & CVE-2026-85534: Improper handling of HTTP/2 requests and transfers can cause denial of service.
- CVE-2026-5119 & CVE-2026-66339: Flaws in HTTPS proxy connections and proxy authentication credential handling may expose sensitive information.
- CVE-2026-6324: Incorrect parsing of chunked HTTP requests can allow security control bypass.
- CVE-2026-77014 & CVE-2026-77680: Improper handling of HTTP Range headers can result in denial of service.
Why it matters
As a core GNOME HTTP client/server library, these vulnerabilities affect the security posture of applications relying on libsoup for network communications on Ubuntu.
Original reference: ubuntu.com →