USN-8890-1: libsoup vulnerabilities

Q: Which Ubuntu releases are explicitly identified as affected by the HTTP/2, HTTPS proxy, and chunked-request issues?

The HTTP/2 denial-of-service issue (CVE-2026-4271) is identified as affecting Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. The HTTPS proxy information-disclosure issue (CVE-2026-5119) and chunked HTTP request security-control bypass (CVE-2026-6324) are identified as affecting Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.

Q: Which deployments should receive particular scrutiny during triage?

Prioritize applications using libsoup to handle HTTP/2 traffic, HTTPS proxy connections, proxy authentication credentials, chunked HTTP requests, or HTTP Range headers. The described outcomes include denial of service, sensitive-information disclosure, and security-control bypass.

Q: Can affected status be determined from the provided package names alone?

No. The data identifies affected libsoup-related Ubuntu packages, including libsoup2.4 and libsoup-3.0 components, but does not provide package version information or fixed-version details needed to determine whether a specific installation is patched.

Published Oct 6, 2026

Updated

It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-4271) It was discovered that libsoup incorrectly handled certain HTTPS proxy connections. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-5119) It was discovered that libsoup incorrectly parsed certain chunked HTTP requests. A remote attacker could possibly use this issue to bypass security controls. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-6324) It was discovered that libsoup incorrectly handled proxy authentication credentials. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-66339) It was discovered that libsoup incorrectly handled certain HTTP Range headers. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-77014, CVE-2026-77680) It was discovered that libsoup incorrectly handled certain HTTP/2 connections. A remote attacker could possibly use this issue to obtain sensitive information or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-85197) It was discovered that libsoup incorrectly handled certain HTTP/2 transfers. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-85534)

Affected Software

91 affected componentsFixes available

libsoup

All of the following

ubuntu/gir1.2-soup-2.4<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=26.04

All of the following

ubuntu/gir1.2-soup-3.0<3.6.6-1ubuntu0.1

3.6.6-1ubuntu0.1

Ubuntu Ubuntu=26.04

All of the following

ubuntu/libsoup-2.4-1<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=26.04

All of the following

ubuntu/libsoup-3.0-0<3.6.6-1ubuntu0.1

3.6.6-1ubuntu0.1

Ubuntu Ubuntu=26.04

All of the following

ubuntu/libsoup-3.0-common<3.6.6-1ubuntu0.1

3.6.6-1ubuntu0.1

Ubuntu Ubuntu=26.04

All of the following

ubuntu/libsoup-3.0-dev<3.6.6-1ubuntu0.1

3.6.6-1ubuntu0.1

Ubuntu Ubuntu=26.04

All of the following

ubuntu/libsoup-gnome-2.4-1<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=26.04

All of the following

ubuntu/libsoup-gnome2.4-dev<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=26.04

All of the following

ubuntu/libsoup2.4-common<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=26.04

All of the following

ubuntu/libsoup2.4-dev<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=26.04

All of the following

ubuntu/gir1.2-soup-2.4<2.74.3-6ubuntu1.9

2.74.3-6ubuntu1.9

Ubuntu Ubuntu=24.04

All of the following

ubuntu/gir1.2-soup-3.0<3.4.4-5ubuntu0.9

3.4.4-5ubuntu0.9

Ubuntu Ubuntu=24.04

All of the following

ubuntu/libsoup-2.4-1<2.74.3-6ubuntu1.9

2.74.3-6ubuntu1.9

Ubuntu Ubuntu=24.04

All of the following

ubuntu/libsoup-3.0-0<3.4.4-5ubuntu0.9

3.4.4-5ubuntu0.9

Ubuntu Ubuntu=24.04

All of the following

ubuntu/libsoup-3.0-common<3.4.4-5ubuntu0.9

3.4.4-5ubuntu0.9

Ubuntu Ubuntu=24.04

All of the following

ubuntu/libsoup-3.0-dev<3.4.4-5ubuntu0.9

3.4.4-5ubuntu0.9

Ubuntu Ubuntu=24.04

All of the following

ubuntu/libsoup-gnome-2.4-1<2.74.3-6ubuntu1.9

2.74.3-6ubuntu1.9

Ubuntu Ubuntu=24.04

All of the following

ubuntu/libsoup-gnome2.4-dev<2.74.3-6ubuntu1.9

2.74.3-6ubuntu1.9

Ubuntu Ubuntu=24.04

All of the following

ubuntu/libsoup2.4-common<2.74.3-6ubuntu1.9

2.74.3-6ubuntu1.9

Ubuntu Ubuntu=24.04

All of the following

ubuntu/libsoup2.4-dev<2.74.3-6ubuntu1.9

2.74.3-6ubuntu1.9

Ubuntu Ubuntu=24.04

All of the following

ubuntu/gir1.2-soup-2.4<2.74.2-3ubuntu0.9

2.74.2-3ubuntu0.9

Ubuntu Ubuntu=22.04

All of the following

ubuntu/gir1.2-soup-3.0<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=22.04

All of the following

ubuntu/libsoup-3.0-0<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=22.04

All of the following

ubuntu/libsoup-3.0-common<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=22.04

All of the following

ubuntu/libsoup-3.0-dev<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=22.04

All of the following

ubuntu/libsoup-gnome2.4-1<2.74.2-3ubuntu0.9

2.74.2-3ubuntu0.9

Ubuntu Ubuntu=22.04

All of the following

ubuntu/libsoup-gnome2.4-dev<2.74.2-3ubuntu0.9

2.74.2-3ubuntu0.9

Ubuntu Ubuntu=22.04

All of the following

ubuntu/libsoup2.4-1<2.74.2-3ubuntu0.9

2.74.2-3ubuntu0.9

Ubuntu Ubuntu=22.04

All of the following

ubuntu/libsoup2.4-common<2.74.2-3ubuntu0.9

2.74.2-3ubuntu0.9

Ubuntu Ubuntu=22.04

All of the following

ubuntu/libsoup2.4-dev<2.74.2-3ubuntu0.9

2.74.2-3ubuntu0.9

Ubuntu Ubuntu=22.04

All of the following

ubuntu/gir1.2-soup-2.4<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=20.04

All of the following

ubuntu/libsoup-gnome2.4-1<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=20.04

All of the following

ubuntu/libsoup-gnome2.4-dev<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=20.04

All of the following

ubuntu/libsoup2.4-1<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=20.04

All of the following

ubuntu/libsoup2.4-dev<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=20.04

All of the following

ubuntu/gir1.2-soup-2.4<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=18.04

All of the following

ubuntu/libsoup-gnome2.4-1<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=18.04

All of the following

ubuntu/libsoup-gnome2.4-dev<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=18.04

All of the following

ubuntu/libsoup2.4-1<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=18.04

All of the following

ubuntu/libsoup2.4-dev<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=18.04

All of the following

ubuntu/gir1.2-soup-2.4<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=16.04

All of the following

ubuntu/libsoup-gnome2.4-1<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=16.04

All of the following

ubuntu/libsoup-gnome2.4-dev<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=16.04

All of the following

ubuntu/libsoup2.4-1<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=16.04

All of the following

ubuntu/libsoup2.4-dev<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=16.04

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/gir1.2-soup-2.4 to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/gir1.2-soup-3.0 to a version that resolves this vulnerability.
Fixed in 3.6.6-1ubuntu0.1
Upgrade
Upgrade ubuntu/libsoup-2.4-1 to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/libsoup-3.0-0 to a version that resolves this vulnerability.
Fixed in 3.6.6-1ubuntu0.1
Upgrade
Upgrade ubuntu/libsoup-3.0-common to a version that resolves this vulnerability.
Fixed in 3.6.6-1ubuntu0.1
Upgrade
Upgrade ubuntu/libsoup-3.0-dev to a version that resolves this vulnerability.
Fixed in 3.6.6-1ubuntu0.1
Upgrade
Upgrade ubuntu/libsoup-gnome-2.4-1 to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/libsoup-gnome2.4-dev to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/libsoup2.4-common to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/libsoup2.4-dev to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/gir1.2-soup-2.4 to a version that resolves this vulnerability.
Fixed in 2.74.3-6ubuntu1.9
Upgrade
Upgrade ubuntu/gir1.2-soup-3.0 to a version that resolves this vulnerability.
Fixed in 3.4.4-5ubuntu0.9
Upgrade
Upgrade ubuntu/libsoup-2.4-1 to a version that resolves this vulnerability.
Fixed in 2.74.3-6ubuntu1.9
Upgrade
Upgrade ubuntu/libsoup-3.0-0 to a version that resolves this vulnerability.
Fixed in 3.4.4-5ubuntu0.9
Upgrade
Upgrade ubuntu/libsoup-3.0-common to a version that resolves this vulnerability.
Fixed in 3.4.4-5ubuntu0.9
Upgrade
Upgrade ubuntu/libsoup-3.0-dev to a version that resolves this vulnerability.
Fixed in 3.4.4-5ubuntu0.9
Upgrade
Upgrade ubuntu/libsoup-gnome-2.4-1 to a version that resolves this vulnerability.
Fixed in 2.74.3-6ubuntu1.9
Upgrade
Upgrade ubuntu/libsoup-gnome2.4-dev to a version that resolves this vulnerability.
Fixed in 2.74.3-6ubuntu1.9
Upgrade
Upgrade ubuntu/libsoup2.4-common to a version that resolves this vulnerability.
Fixed in 2.74.3-6ubuntu1.9
Upgrade
Upgrade ubuntu/libsoup2.4-dev to a version that resolves this vulnerability.
Fixed in 2.74.3-6ubuntu1.9
Upgrade
Upgrade ubuntu/gir1.2-soup-2.4 to a version that resolves this vulnerability.
Fixed in 2.74.2-3ubuntu0.9
Upgrade
Upgrade ubuntu/gir1.2-soup-3.0 to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/libsoup-3.0-0 to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/libsoup-3.0-common to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/libsoup-3.0-dev to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/libsoup-gnome2.4-1 to a version that resolves this vulnerability.
Fixed in 2.74.2-3ubuntu0.9
Upgrade
Upgrade ubuntu/libsoup-gnome2.4-dev to a version that resolves this vulnerability.
Fixed in 2.74.2-3ubuntu0.9
Upgrade
Upgrade ubuntu/libsoup2.4-1 to a version that resolves this vulnerability.
Fixed in 2.74.2-3ubuntu0.9
Upgrade
Upgrade ubuntu/libsoup2.4-common to a version that resolves this vulnerability.
Fixed in 2.74.2-3ubuntu0.9
Upgrade
Upgrade ubuntu/libsoup2.4-dev to a version that resolves this vulnerability.
Fixed in 2.74.2-3ubuntu0.9
Upgrade
Upgrade ubuntu/libsoup-gnome2.4-1 to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/libsoup2.4-1 to a version that resolves this vulnerability.
Fixed in Ubuntu Pro

Event History

Oct 6, 2026

Advisory Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which Ubuntu releases are explicitly identified as affected by the HTTP/2, HTTPS proxy, and chunked-request issues?

The HTTP/2 denial-of-service issue (CVE-2026-4271) is identified as affecting Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. The HTTPS proxy information-disclosure issue (CVE-2026-5119) and chunked HTTP request security-control bypass (CVE-2026-6324) are identified as affecting Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.

Which deployments should receive particular scrutiny during triage?

Prioritize applications using libsoup to handle HTTP/2 traffic, HTTPS proxy connections, proxy authentication credentials, chunked HTTP requests, or HTTP Range headers. The described outcomes include denial of service, sensitive-information disclosure, and security-control bypass.

Can affected status be determined from the provided package names alone?

No. The data identifies affected libsoup-related Ubuntu packages, including libsoup2.4 and libsoup-3.0 components, but does not provide package version information or fixed-version details needed to determine whether a specific installation is patched.

USN-8890-1: libsoup vulnerabilities

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which Ubuntu releases are explicitly identified as affected by the HTTP/2, HTTPS proxy, and chunked-request issues?

Which deployments should receive particular scrutiny during triage?

Can affected status be determined from the provided package names alone?

Company

Resources

Contact

Frequently Asked Questions

Which Ubuntu releases are explicitly identified as affected by the HTTP/2, HTTPS proxy, and chunked-request issues?

Which deployments should receive particular scrutiny during triage?

Can affected status be determined from the provided package names alone?