REDHAT-BUG-2520143: Medium severity Gnome libsoup vulnerability
A flaw was found in libsoup's SoupServer HTTP Range header processing. The sortranges() comparator function in soup-message-headers.c returns the difference of two goffset (64-bit) values as an int (32-bit). When two range start positions in a multi-range request differ by more than INTMAX (~2.1 billion), the truncation flips the comparison result sign, violating qsort's ordering contract. The mis-sorted ranges are then incorrectly merged, causing the server to silently omit requested byte ranges from the HTTP 206 Partial Content response. A remote unauthenticated attacker can trigger this by sending a multi-range Range request for a resource larger than approximately 2 GB, with range start offsets more than INTMAX apart. The client receives fewer ranges than requested with no error indication, compromising data integrity for resumable downloads, delta updates, mirror synchronization, and chunked verification of large objects.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Servers using libsoup's SoupServer are exposed when they serve resources larger than approximately 2 GB and process multi-range HTTP requests whose requested starting offsets differ by more than INT_MAX, about 2.1 billion bytes.
What does an attacker need to exploit it?
The attacker only needs remote, unauthenticated access to send a crafted multi-range Range request for a sufficiently large resource. No authentication requirement is described.
What is the practical impact of a successful request?
The server can return an HTTP 206 Partial Content response that silently omits requested byte ranges. This can compromise integrity-sensitive workflows such as resumable downloads, delta updates, mirror synchronization, and chunked verification of large objects.