CVE-2026-77014: Libsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responses
A flaw was found in libsoup's SoupServer HTTP Range header processing. The sortranges() comparator function in soup-message-headers.c returns the difference of two goffset (64-bit) values as an int (32-bit). When two range start positions in a multi-range request differ by more than INTMAX (~2.1 billion), the truncation flips the comparison result sign, violating qsort's ordering contract. The mis-sorted ranges are then incorrectly merged, causing the server to silently omit requested byte ranges from the HTTP 206 Partial Content response. A remote unauthenticated attacker can trigger this by sending a multi-range Range request for a resource larger than approximately 2 GB, with range start offsets more than INTMAX apart. The client receives fewer ranges than requested with no error indication, compromising data integrity for resumable downloads, delta updates, mirror synchronization, and chunked verification of large objects.
Other sources
A flaw was found in libsoup's SoupServer HTTP Range header processing. The sortranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INTMAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using libsoup's SoupServer HTTP Range header processing are exposed when they serve resources larger than approximately 2 GB and honor multi-range requests. The issue affects HTTP 206 Partial Content responses.
What does an attacker need to send to trigger the flaw?
An unauthenticated remote attacker must send a multi-range Range request whose range start offsets differ by more than INT_MAX, approximately 2.1 billion bytes. The targeted resource must be larger than approximately 2 GB.
What is the observable impact of a successful exploit?
The server can incorrectly merge mis-sorted ranges and silently omit requested byte ranges from its HTTP 206 response. The client receives fewer ranges than requested without an error, which can compromise integrity-sensitive resumable downloads, delta updates, mirror synchronization, and chunked verification.