TI-2026-03716 CVE-2026-4271 · GHSA-xxmc-fm3p-q3x8
Libsoup: libsoup: denial of service via use-after-free in http/2 server
Priority HIGH 72
A flaw was found in libsoup, a library for handling HTTP requests.
GNOME
Records403All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical33CVSS 9.0–10.0
CVSS high157CVSS 7.0–8.9
Exploited now
GNOME records in CISA KEVNo GNOME vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
35 records in Libsoup · all components
TI-2024-35201 CVE-2024-52531 · GHSA-5mc3-gwcr-mgc3
Out-of-bounds write in GNOME libsoup
Priority HIGH 70
GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_parse_param_list_strict.
TI-2025-02434 CVE-2025-2784 · GHSA-5qxx-2mqf-3v7g
Libsoup: heap buffer over-read in `skip_insignificant_space` when sniffing content
Priority MEDIUM 64
A flaw was found in libsoup.
TI-2026-03134 CVE-2026-3634 · GHSA-jx6g-363c-pprr
Libsoup: libsoup: http header injection and response splitting via crlf injection in content-type header
Priority MEDIUM 62
A flaw was found in libsoup.
TI-2017-02105 CVE-2017-2885 · GHSA-qq4w-8g63-5r25
Out-of-bounds write in GNOME libsoup
Priority MEDIUM 62
An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58.
TI-2026-10764 CVE-2026-12548 · GHSA-wmh6-vpqv-v8q3
Libsoup: heap out-of-bounds read in libsoup due to integer truncation
Priority MEDIUM 53
A heap out-of-bounds read flaw was found in libsoup.
TI-2026-65425 CVE-2026-102560 · GHSA-9v45-6jmj-gmwr
Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth
Priority MEDIUM 49
A flaw was found in libsoup.
TI-2018-09275 CVE-2018-12910 · GHSA-wv8f-jq6c-45j5
The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have…
Priority MEDIUM 49
The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname.
TI-2019-12881 CVE-2019-17266 · GHSA-wcxh-xxc8-v5j8
libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because…
Priority MEDIUM 47
libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soup_ntlm_parse_challenge() in soup-auth-ntlm.c does not properly check an NTLM message's length before proceeding with a memcpy.
TI-2026-02005 CVE-2026-2369 · GHSA-rm63-3cv3-qm5w
Libsoup: libsoup: buffer overread due to integer underflow when handling zero-length resources
Priority MEDIUM 46
A flaw was found in libsoup.
TI-2026-65424 CVE-2026-102559 · GHSA-cj4p-f4hv-cp74
Libsoup: libsoup: heap buffer overflow during websocket client-frame masking
Priority MEDIUM 44
A flaw was found in libsoup.
TI-2026-65423 CVE-2026-102558 · GHSA-xxgh-qh6h-jxc2
Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth
Priority MEDIUM 44
A flaw was found in libsoup.
TI-2026-65422 CVE-2026-102557 · GHSA-fc8r-xmg7-v58h
Libsoup: libsoup: heap buffer overflow during websocket message reassembly
Priority MEDIUM 44
A flaw was found in libsoup.
TI-2026-65421 CVE-2026-102556 · GHSA-q4x2-vf8m-46j5
Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion
Priority MEDIUM 44
A flaw was found in libsoup.
TI-2026-65420 CVE-2026-102555 · GHSA-vfxx-hcqj-vrh4
Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decoding
Priority MEDIUM 42
A flaw was found in libsoup.
TI-2024-35202 CVE-2024-52532 · GHSA-f6qg-rg6j-cxgf
GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption.
Priority MEDIUM 41
GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption.
TI-2024-35200 CVE-2024-52530 · GHSA-37r8-854r-595c
GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because…
Priority MEDIUM 40
GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is treated the same as a "Tran…
TI-2026-02068 CVE-2026-2436 · GHSA-wpfw-5xvc-wq9w
Libsoup: libsoup: denial of service via use-after-free in soupserver during tls handshake
Priority LOW 36
A flaw was found in libsoup's SoupServer.
TI-2026-04469 CVE-2026-5119 · GHSA-j666-j6hj-fpc7
Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment
Priority LOW 35
A flaw was found in libsoup.
TI-2026-01479 CVE-2026-1801 · GHSA-xv49-34rf-rqv4
Libsoup: libsoup: http request smuggling via malformed chunk headers
Priority LOW 35
A flaw was found in libsoup, an HTTP client/server library.
TI-2026-47124 CVE-2026-66337 · GHSA-ww4c-c3rv-f96h
Libsoup: libsoup: heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()
Priority LOW 34
A flaw was found in libsoup.
TI-2026-02676 CVE-2026-3099 · GHSA-hrf3-6c7v-5628
Libsoup: libsoup: authentication bypass via digest authentication replay attack
Priority LOW 32
A flaw was found in Libsoup.
TI-2026-01228 CVE-2026-1539 · GHSA-wj9p-f539-2mhr
Libsoup: libsoup: credential leakage via http redirects
Priority LOW 32
A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations.
TI-2026-01226 CVE-2026-1536 · GHSA-x4cc-vgcc-h5h4
Libsoup: libsoup: http header injection or response splitting via crlf injection in content-disposition header
Priority LOW 32
A flaw was found in libsoup.
TI-2018-08377 CVE-2018-11713 · GHSA-q6g9-cxvx-7pq9
WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network…
Priority LOW 32
WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ prior to version 2.20.0 or without libsoup 2.62.0, unexpectedly failed to use system proxy sett…