CVE-2026-77680: Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix
An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libsoup3to a version that resolves this vulnerability.Fixed in 3.8.0-2 - Upgrade
Upgrade
libsoup3to a version that resolves this vulnerability.Patch !550
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Server-side applications using libsoup are exposed when a SoupServer handler returns HTTP 200 with a non-empty response body. The vulnerable processing path is reached while handling HTTP/1 partial GET requests.
What does an attacker need to send?
No authentication is required. An attacker can send a Range header containing many identical satisfiable ranges, such as repeated bytes=0-0 entries, causing quadratic CPU work during range coalescing.
Are requests limited enough to prevent practical impact?
The range count is limited only by the maximum request-header size of approximately 100 KiB, which can hold roughly 25,000 ranges in one request. Reporter measurements on a libsoup HEAD build containing the earlier fix observed about 90 ms of single-core CPU time per such request.