# Ubuntu releases libsoup3 updates to address multiple vulnerabilities

> **Key takeaway:** Multiple vulnerabilities in the libsoup HTTP library could lead to denial of service, information disclosure, or arbitrary code execution.

**Published:** 2026-10-21T21:36:06+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/ubuntu-releases-libsoup3-updates-to-address-multiple-vulnera.html 

## Summary
Ubuntu has released security updates for libsoup3 on Ubuntu 26.10 to address several vulnerabilities. These flaws involve incorrect handling of HTTP/2 requests, HTTPS proxy connections, and chunked HTTP requests, potentially allowing remote attackers to cause denial of service or steal sensitive data.

## Vulnerabilities in libsoup3
- **CVE-2026-85197**: Incorrect HTTP/2 connection handling could lead to sensitive information disclosure or arbitrary code execution.
- **CVE-2026-4271 & CVE-2026-85534**: Improper handling of HTTP/2 requests and transfers can cause denial of service.
- **CVE-2026-5119 & CVE-2026-66339**: Flaws in HTTPS proxy connections and proxy authentication credential handling may expose sensitive information.
- **CVE-2026-6324**: Incorrect parsing of chunked HTTP requests can allow security control bypass.
- **CVE-2026-77014 & CVE-2026-77680**: Improper handling of HTTP Range headers can result in denial of service.

## Why it matters
As a core GNOME HTTP client/server library, these vulnerabilities affect the security posture of applications relying on libsoup for network communications on Ubuntu.