Read the docs
TI-2011-02216 Aliases CVE-2011-2524GHSA-xm6g-x36q-hxpx

Directory traversal vulnerability in soup-uri.c in SoupServer in libsoup before 2.35.4…

Priority LOW 27CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Partial · None · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

Directory traversal vulnerability in soup-uri.c in SoupServer in libsoup before 2.35.4 allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in a URI.

Why it matters now

EPSS 0.01925 80th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 74

CPEVersionsRoleVendor
cpe:2.3:a:gnome:libsoup:*:*:*:*:*:*:*:*up to 2.35.3VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.0:*:*:*:*:*:*:*2.0VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.2:*:*:*:*:*:*:*2.2VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.2.1:*:*:*:*:*:*:*2.2.1VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.2.2:*:*:*:*:*:*:*2.2.2VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.2.3:*:*:*:*:*:*:*2.2.3VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.2.4:*:*:*:*:*:*:*2.2.4VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.2.5:*:*:*:*:*:*:*2.2.5VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.2.6:*:*:*:*:*:*:*2.2.6VulnerableGNOME
  • cpe:2.3:a:gnome:libsoup:*:*:*:*:*:*:*:* Versions up to 2.35.3 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.2.2:*:*:*:*:*:*:* Versions 2.2.2 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.2.4:*:*:*:*:*:*:* Versions 2.2.4 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.2.5:*:*:*:*:*:*:* Versions 2.2.5 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.2.6:*:*:*:*:*:*:* Versions 2.2.6 Vulnerable ·GNOME
Show 64 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:gnome:libsoup:2.2.6.1:*:*:*:*:*:*:*2.2.6.1VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.2.7:*:*:*:*:*:*:*2.2.7VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.2.91:*:*:*:*:*:*:*2.2.91VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.2.92:*:*:*:*:*:*:*2.2.92VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.2.93:*:*:*:*:*:*:*2.2.93VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.2.94:*:*:*:*:*:*:*2.2.94VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.2.95.1:*:*:*:*:*:*:*2.2.95.1VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.2.96:*:*:*:*:*:*:*2.2.96VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.2.97:*:*:*:*:*:*:*2.2.97VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.2.98:*:*:*:*:*:*:*2.2.98VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.2.99:*:*:*:*:*:*:*2.2.99VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.2.100:*:*:*:*:*:*:*2.2.100VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.2.101:*:*:*:*:*:*:*2.2.101VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.2.102:*:*:*:*:*:*:*2.2.102VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.2.103:*:*:*:*:*:*:*2.2.103VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.2.104:*:*:*:*:*:*:*2.2.104VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.3.0.1:*:*:*:*:*:*:*2.3.0.1VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.3.2:*:*:*:*:*:*:*2.3.2VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.3.4:*:*:*:*:*:*:*2.3.4VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.4.0:*:*:*:*:*:*:*2.4.0VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.4.1:*:*:*:*:*:*:*2.4.1VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.23.1:*:*:*:*:*:*:*2.23.1VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.23.6:*:*:*:*:*:*:*2.23.6VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.23.91:*:*:*:*:*:*:*2.23.91VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.23.92:*:*:*:*:*:*:*2.23.92VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.24.0.1:*:*:*:*:*:*:*2.24.0.1VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.24.1:*:*:*:*:*:*:*2.24.1VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.25.2:*:*:*:*:*:*:*2.25.2VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.25.3:*:*:*:*:*:*:*2.25.3VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.25.4:*:*:*:*:*:*:*2.25.4VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.25.5:*:*:*:*:*:*:*2.25.5VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.25.91:*:*:*:*:*:*:*2.25.91VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.26.0:*:*:*:*:*:*:*2.26.0VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.26.1:*:*:*:*:*:*:*2.26.1VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.27.1:*:*:*:*:*:*:*2.27.1VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.27.2:*:*:*:*:*:*:*2.27.2VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.27.4:*:*:*:*:*:*:*2.27.4VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.27.5:*:*:*:*:*:*:*2.27.5VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.27.90:*:*:*:*:*:*:*2.27.90VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.27.91:*:*:*:*:*:*:*2.27.91VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.27.92:*:*:*:*:*:*:*2.27.92VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.28.0:*:*:*:*:*:*:*2.28.0VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.28.1:*:*:*:*:*:*:*2.28.1VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.29.3:*:*:*:*:*:*:*2.29.3VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.29.5:*:*:*:*:*:*:*2.29.5VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.29.6:*:*:*:*:*:*:*2.29.6VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.29.90:*:*:*:*:*:*:*2.29.90VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.29.91:*:*:*:*:*:*:*2.29.91VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.30.0:*:*:*:*:*:*:*2.30.0VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.30.1:*:*:*:*:*:*:*2.30.1VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.31.2:*:*:*:*:*:*:*2.31.2VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.31.6:*:*:*:*:*:*:*2.31.6VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.31.90:*:*:*:*:*:*:*2.31.90VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.31.92:*:*:*:*:*:*:*2.31.92VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.32.0:*:*:*:*:*:*:*2.32.0VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.32.1:*:*:*:*:*:*:*2.32.1VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.32.2:*:*:*:*:*:*:*2.32.2VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.33.4:*:*:*:*:*:*:*2.33.4VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.33.5:*:*:*:*:*:*:*2.33.5VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.33.6:*:*:*:*:*:*:*2.33.6VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.33.90:*:*:*:*:*:*:*2.33.90VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.33.92:*:*:*:*:*:*:*2.33.92VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.34.0:*:*:*:*:*:*:*2.34.0VulnerableGNOME
cpe:2.3:a:gnome:libsoup:2.34.1:*:*:*:*:*:*:*2.34.1VulnerableGNOME
  • cpe:2.3:a:gnome:libsoup:2.2.6.1:*:*:*:*:*:*:* Versions 2.2.6.1 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.2.7:*:*:*:*:*:*:* Versions 2.2.7 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.2.91:*:*:*:*:*:*:* Versions 2.2.91 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.2.92:*:*:*:*:*:*:* Versions 2.2.92 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.2.93:*:*:*:*:*:*:* Versions 2.2.93 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.2.94:*:*:*:*:*:*:* Versions 2.2.94 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.2.95.1:*:*:*:*:*:*:* Versions 2.2.95.1 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.2.96:*:*:*:*:*:*:* Versions 2.2.96 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.2.97:*:*:*:*:*:*:* Versions 2.2.97 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.2.98:*:*:*:*:*:*:* Versions 2.2.98 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.2.99:*:*:*:*:*:*:* Versions 2.2.99 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.2.100:*:*:*:*:*:*:* Versions 2.2.100 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.2.101:*:*:*:*:*:*:* Versions 2.2.101 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.2.102:*:*:*:*:*:*:* Versions 2.2.102 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.2.103:*:*:*:*:*:*:* Versions 2.2.103 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.2.104:*:*:*:*:*:*:* Versions 2.2.104 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.3.0.1:*:*:*:*:*:*:* Versions 2.3.0.1 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.3.2:*:*:*:*:*:*:* Versions 2.3.2 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.3.4:*:*:*:*:*:*:* Versions 2.3.4 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.4.0:*:*:*:*:*:*:* Versions 2.4.0 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.4.1:*:*:*:*:*:*:* Versions 2.4.1 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.23.1:*:*:*:*:*:*:* Versions 2.23.1 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.23.6:*:*:*:*:*:*:* Versions 2.23.6 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.23.91:*:*:*:*:*:*:* Versions 2.23.91 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.23.92:*:*:*:*:*:*:* Versions 2.23.92 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.24.0.1:*:*:*:*:*:*:* Versions 2.24.0.1 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.24.1:*:*:*:*:*:*:* Versions 2.24.1 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.25.2:*:*:*:*:*:*:* Versions 2.25.2 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.25.3:*:*:*:*:*:*:* Versions 2.25.3 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.25.4:*:*:*:*:*:*:* Versions 2.25.4 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.25.5:*:*:*:*:*:*:* Versions 2.25.5 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.25.91:*:*:*:*:*:*:* Versions 2.25.91 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.26.0:*:*:*:*:*:*:* Versions 2.26.0 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.26.1:*:*:*:*:*:*:* Versions 2.26.1 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.27.1:*:*:*:*:*:*:* Versions 2.27.1 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.27.2:*:*:*:*:*:*:* Versions 2.27.2 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.27.4:*:*:*:*:*:*:* Versions 2.27.4 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.27.5:*:*:*:*:*:*:* Versions 2.27.5 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.27.90:*:*:*:*:*:*:* Versions 2.27.90 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.27.91:*:*:*:*:*:*:* Versions 2.27.91 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.27.92:*:*:*:*:*:*:* Versions 2.27.92 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.28.0:*:*:*:*:*:*:* Versions 2.28.0 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.28.1:*:*:*:*:*:*:* Versions 2.28.1 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.29.3:*:*:*:*:*:*:* Versions 2.29.3 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.29.5:*:*:*:*:*:*:* Versions 2.29.5 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.29.6:*:*:*:*:*:*:* Versions 2.29.6 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.29.90:*:*:*:*:*:*:* Versions 2.29.90 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.29.91:*:*:*:*:*:*:* Versions 2.29.91 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.30.0:*:*:*:*:*:*:* Versions 2.30.0 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.30.1:*:*:*:*:*:*:* Versions 2.30.1 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.31.2:*:*:*:*:*:*:* Versions 2.31.2 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.31.6:*:*:*:*:*:*:* Versions 2.31.6 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.31.90:*:*:*:*:*:*:* Versions 2.31.90 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.31.92:*:*:*:*:*:*:* Versions 2.31.92 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.32.0:*:*:*:*:*:*:* Versions 2.32.0 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.32.1:*:*:*:*:*:*:* Versions 2.32.1 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.32.2:*:*:*:*:*:*:* Versions 2.32.2 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.33.4:*:*:*:*:*:*:* Versions 2.33.4 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.33.5:*:*:*:*:*:*:* Versions 2.33.5 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.33.6:*:*:*:*:*:*:* Versions 2.33.6 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.33.90:*:*:*:*:*:*:* Versions 2.33.90 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.33.92:*:*:*:*:*:*:* Versions 2.33.92 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.34.0:*:*:*:*:*:*:* Versions 2.34.0 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:libsoup:2.34.1:*:*:*:*:*:*:* Versions 2.34.1 Vulnerable ·GNOME

Remediation

Red Hat 1 advisory

  • RHSA-2011:1102 Released 2011-07-28 · Red Hat rating Moderate
    libsoup security update
    • Red Hat Enterprise Linux Server (v. 6) libsoup-2.28.2-1.el6_1.1, libsoup-2.28.2-1.el6_1.1.ppc, libsoup-devel-2.28.2-1.el6_1.1 +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2011:1102
Not affected: 2 products
  • Red Hat Enterprise Linux 4
  • Red Hat Enterprise Linux 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-2524
  2. 2026-10-03 Alias added: GHSA-xm6g-x36q-hxpx

References

Patch 1

Advisory 4

Other 1

  • TI-2026-03716 Libsoup: libsoup: denial of service via use-after-free in http/2 server CVSS 3.1HIGH 7.5
  • TI-2024-35201 Out-of-bounds write in GNOME libsoup CVSS 3.1HIGH 8.4
  • TI-2025-02434 Libsoup: heap buffer over-read in `skip_insignificant_space` when sniffing content CVSS 3.1HIGH 7.0
  • TI-2026-03134 Libsoup: libsoup: http header injection and response splitting via crlf injection in content-type header CVSS 3.1MEDIUM 6.5
  • TI-2017-02105 Out-of-bounds write in GNOME libsoup CVSS 3.1CRITICAL 9.8
  • TI-2026-10764 Libsoup: heap out-of-bounds read in libsoup due to integer truncation CVSS 3.1MEDIUM 4.2
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences