CVE-2019-17266: Critical severity Gnome libsoup vulnerability
Last updated 25 August 2025
Other sources
libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soupntlmparsechallenge() in soup-auth-ntlm.c does not properly check an NTLM message's length before proceeding with a memcpy.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-17266?
The severity of CVE-2019-17266 is critical, with a severity value of 9.8.
How does CVE-2019-17266 impact the software?
CVE-2019-17266 can lead to a heap-based buffer over-read vulnerability in libsoup versions 2.65.1 until 2.68.1.
What is the recommended version to fix CVE-2019-17266 on Ubuntu?
The recommended version to fix CVE-2019-17266 on Ubuntu is libsoup2.4 2.68.2.
Where can I find more information about CVE-2019-17266?
You can find more information about CVE-2019-17266 at the following references: [1](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=941912), [2](https://github.com/Kirin-say/Vulnerabilities/blob/master/CVE-2019-17266_POC.md), [3](https://gitlab.gnome.org/GNOME/libsoup/commit/88b7dff4467f4151afae244ea7d1223753cd05ab).
What is the Common Weakness Enumeration (CWE) for CVE-2019-17266?
The CWE for CVE-2019-17266 is CWE-125.