REDHAT-BUG-2506949: Medium severity Gnome libsoup vulnerability
An unsigned integer underflow in soupfilterinputstreamreaduntil() in libsoup/soup-filter-input-stream.c causes a heap buffer over-read when parsing multipart HTTP responses. When includeboundary is FALSE and the internal buffer contains fewer bytes than the boundary string length, the subtraction of two unsigned values wraps to a very large number, causing the boundary scan loop to read beyond the heap allocation. A malicious HTTP server can trigger this against any libsoup client using SoupMultipartInputStream. This is related to but distinct from CVE-2026-1761 — Red Hat's downstream fix for that CVE does not resolve this issue.
Upstream report: https://gitlab.gnome.org/GNOME/libsoup/-/workitems/532 PSIRTSUPT: https://redhat.atlassian.net/browse/PSIRTSUPT-17666
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch PSIRTSUPT-17666 - Compensating control
Apply mitigations by preventing clients from connecting to untrusted/malicious HTTP servers that can send crafted multipart HTTP responses to libsoup clients using SoupMultipartInputStream.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2506949?
The severity of REDHAT-BUG-2506949 is medium with a score of 4.
What causes the vulnerability REDHAT-BUG-2506949?
REDHAT-BUG-2506949 is caused by an unsigned integer underflow in the soup_filter_input_stream_read_until() function.
What are the potential impacts of REDHAT-BUG-2506949?
The vulnerability can result in a heap buffer over-read when parsing multipart HTTP responses.
Is my software affected by REDHAT-BUG-2506949?
If you are using Gnome libsoup, your software may be affected by REDHAT-BUG-2506949.
How do I fix REDHAT-BUG-2506949?
To fix REDHAT-BUG-2506949, you should update to the latest version of Gnome libsoup provided by your distribution.