CVE-2026-77680: Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix
An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix.
CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soupmessageheadersgetrangesinternal() in libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using garrayremoveindex() for each coalesced element. Because GArray is contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N²) work coalescing them into a single range.
The vulnerable path is reachable server-side from handlepartialget() in libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required. The number of ranges is bounded only by the maximum request header size (~100 KiB), allowing roughly 25,000 ranges per request. Reporter measurements on libsoup HEAD containing the CVE-2025-32907 fix show ~90 ms single-core CPU per such request at the wire maximum, blocking the server's event loop for that duration.
This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs.
Affected: libsoup versions containing the CVE-2025-32907 fix but not merge request !550. Fixed upstream: MR !550 merged 2026-08-20, replacing per-element removal with O(N) in-place compaction and rejecting Range headers requesting more than 200 ranges. Upstream report: https://gitlab.gnome.org/GNOME/libsoup/-/issues/538 Related: CVE-2025-32907
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libsoupto a version that resolves this vulnerability.Patch MR !550
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Server-side applications using libsoup are exposed when a SoupServer handler returns HTTP 200 with a non-empty response body. The vulnerable processing path is reached while handling HTTP/1 partial GET requests.
What does an attacker need to send?
No authentication is required. An attacker can send a Range header containing many identical satisfiable ranges, such as repeated bytes=0-0 entries, causing quadratic CPU work during range coalescing.
Are requests limited enough to prevent practical impact?
The range count is limited only by the maximum request-header size of approximately 100 KiB, which can hold roughly 25,000 ranges in one request. Reporter measurements on a libsoup HEAD build containing the earlier fix observed about 90 ms of single-core CPU time per such request.