CVE-2026-66337: Libsoup: libsoup: heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()
A flaw was found in libsoup. An unsigned integer underflow in the soupfilterinputstreamreaduntil() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory.
Other sources
An unsigned integer underflow in soupfilterinputstreamreaduntil() in libsoup/soup-filter-input-stream.c causes a heap buffer over-read when parsing multipart HTTP responses. When includeboundary is FALSE and the internal buffer contains fewer bytes than the boundary string length, the subtraction of two unsigned values wraps to a very large number, causing the boundary scan loop to read beyond the heap allocation. A malicious HTTP server can trigger this against any libsoup client using SoupMultipartInputStream. This is related to but distinct from CVE-2026-1761 — Red Hat's downstream fix for that CVE does not resolve this issue.
Upstream report: https://gitlab.gnome.org/GNOME/libsoup/-/workitems/532 PSIRTSUPT: https://redhat.atlassian.net/browse/PSIRTSUPT-17666
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66337?
The severity of CVE-2026-66337 is classified as medium with a score of 6.5.
How do I fix CVE-2026-66337?
To fix CVE-2026-66337, update to the latest version of Gnome libsoup that addresses the heap buffer over-read vulnerability.
What are the consequences of CVE-2026-66337?
The consequences of CVE-2026-66337 include potential exploitation by a malicious HTTP server that can send crafted multipart responses.
What software is affected by CVE-2026-66337?
CVE-2026-66337 affects Gnome libsoup, specifically related to the handling of multipart HTTP responses.
How is CVE-2026-66337 exploited?
CVE-2026-66337 can be exploited through an unsigned integer underflow in the soup_filter_input_stream_read_until() function during the parsing of multipart HTTP responses.