CVE-2026-2369: Libsoup: libsoup: buffer overread due to integer underflow when handling zero-length resources
A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This can allow an attacker to potentially access sensitive information or cause an application level denial of service.
Other sources
Integer underflow in CVE-2025-32052 fix when resourcelength=0
The fix for CVE-2025-32052 (commit a5b86bfc) introduces a potential integer underflow vulnerability when resourcelength is 0.
Affected Code: libsoup/soup-content-sniffer.c, line 507
Issue: The patch changes the condition from: while ((indexstream < resourcelength) && ...) to: while ((indexstream < resourcelength - 1) && ...)
When buffer->length = 0:
resourcelength = MIN(512, 0) = 0 resourcelength - 1 underflows to UINTMAX (gsize is unsigned) Condition (0 < UINTMAX) = TRUE Loop executes on empty buffer → buffer overread Fix: Add guard before hasws path: if (resourcelength == 0) continue;
This matches the pattern used in the else branch which already checks: if (resourcelength < typerow->patternlength) continue;
Patch :
--- a/libsoup/soup-content-sniffer.c +++ b/libsoup/soup-content-sniffer.c @@ -498,6 +498,11 @@ sniffunknown (SoupContentSniffer sniffer, SoupBuffer buffer, if (!sniffscriptable && typerow->scriptable) continue; + / Ensure we have data to sniff - prevents underflow in resourcelength - 1 / + if (resourcelength == 0) + continue; + if (typerow->hasws) { guint indexstream = 0; guint indexpattern = 0;
— Red Hat
Libsoup: libsoup: buffer overread due to integer underflow when handling zero-length resources
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libsoup3to a version that resolves this vulnerability.Fixed in 3.6.6-1 - Configuration
Apply the guard in libsoup/soup-content-sniffer.c (sniff_unknown): before entering the has_ws path, add `if (resource_length == 0) continue;` to prevent the `resource_length - 1` unsigned underflow (CVE-2025-32052).
libsoup (soup-content-sniffer.c) resource_length guard in sniff_unknown (has_ws path) = if (resource_length == 0) continue;
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2369?
CVE-2026-2369 is rated as a medium severity vulnerability due to its potential for buffer overread.
How do I fix CVE-2026-2369?
To mitigate CVE-2026-2369, ensure that you update to the latest version of libsoup that addresses this integer underflow vulnerability.
What type of systems are affected by CVE-2026-2369?
CVE-2026-2369 primarily affects systems using the GNOME libsoup library.
What can an attacker potentially do with CVE-2026-2369?
An attacker could potentially leverage CVE-2026-2369 to access sensitive memory content through buffer overreads.
Is there a workaround for CVE-2026-2369?
Currently, the most effective action against CVE-2026-2369 is to apply the relevant security patches provided by the vendor.