CVE-2026-1761: Libsoup: stack-based buffer overflow in libsoup multipart response parsingmultipart http response
A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by sending a specially crafted multipart HTTP response, which can lead to memory corruption. This issue may result in application crashes or arbitrary code execution in applications that process untrusted server responses, and it does not require authentication or user interaction.
Other sources
Stack-based buffer overflow vulnerability in libsoup’s multipart/form-data response parsing logic. The flaw exists in the soupfilterinputstreamreaduntil() function, where an incorrect length calculation may cause more data to be copied than the size of the caller-provided buffer. When a specially crafted multipart HTTP response is processed, libsoup can write past the end of a stack buffer, resulting in memory corruption. This issue can be triggered remotely without authentication or user interaction, potentially leading to application crashes or arbitrary code execution in applications that parse untrusted server responses.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1761?
CVE-2026-1761 has been rated with a high severity due to the potential for remote exploitation through a stack-based buffer overflow.
How do I fix CVE-2026-1761?
To fix CVE-2026-1761, update libsoup to the latest version that addresses this vulnerability.
Who is affected by CVE-2026-1761?
CVE-2026-1761 affects all versions of libsoup that use multipart HTTP response parsing.
What are the potential impacts of CVE-2026-1761?
Exploiting CVE-2026-1761 can lead to arbitrary code execution and potentially compromise the system.
Can CVE-2026-1761 be exploited remotely?
Yes, CVE-2026-1761 can be exploited remotely by an attacker who sends a specially crafted multipart HTTP response.