USN-8890-3: libsoup3 regression
USN-8890-1 fixed vulnerabilities in libsoup. Unfortunately, that update introduced a memory leak in the cookie jar and could introduce a regression. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-4271)
It was discovered that libsoup incorrectly handled certain HTTPS proxy connections. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-5119)
It was discovered that libsoup incorrectly parsed certain chunked HTTP requests. A remote attacker could possibly use this issue to bypass security controls. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-6324)
It was discovered that libsoup incorrectly handled proxy authentication credentials. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-66339)
It was discovered that libsoup incorrectly handled certain HTTP Range headers. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-77014, CVE-2026-77680)
It was discovered that libsoup incorrectly handled certain HTTP/2 connections. A remote attacker could possibly use this issue to obtain sensitive information or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-85197)
It was discovered that libsoup incorrectly handled certain HTTP/2 transfers. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-85534)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libsoup3to a version that resolves this vulnerability.Fixed in 3.4.4-5ubuntu0.11 - Upgrade
Upgrade
ubuntu/libsoup3to a version that resolves this vulnerability.Fixed in 3.6.6-1ubuntu3.2 - Upgrade
Upgrade
ubuntu/libsoup3to a version that resolves this vulnerability.Fixed in 3.6.6-1ubuntu0.3 - Upgrade
Upgrade
libsoupto a version that resolves this vulnerability.Patch USN-8890-1
Event History
Frequently Asked Questions
What should administrators do if they installed the earlier USN-8890-1 update?
Apply this update, which fixes a memory leak in the cookie jar introduced by the earlier update. The earlier update could also introduce a regression.
Which Ubuntu releases are affected by the HTTP/2, HTTPS proxy, and chunked-request issues?
The HTTP/2 denial-of-service issue affects Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. The HTTPS proxy information-disclosure and chunked-request security-control bypass issues affect Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
What conditions would an attacker need to target for the original issues?
The reported attack paths involve specially handled HTTP/2 requests, HTTPS proxy connections, chunked HTTP requests, and proxy authentication credentials. The advisory describes the attacker as remote for the HTTP/2, HTTPS proxy, and chunked-request issues.