Last updated 24 July 2024

A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication. When processing extremely long passwords, an internal size calculation can overflow due to improper use of signed integers. This results in incorrect memory allocation on the stack, followed by unsafe memory copying. As a result, applications using libsoup may crash unexpectedly, creating a denial-of-service risk.

A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by sending a specially crafted multipart HTTP response, which can lead to memory corruption. This issue may result in application crashes or arbitrary code execution in applications that process untrusted server responses, and it does not require authentication or user interaction.

A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file body is being read asynchronously. This can lead to memory corruption, potentially resulting in information disclosure or arbitrary code execution.

A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests.

GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is treated the same as a "Transfer-Encoding: chunked" header.

GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soupheaderparseparamliststrict. Input received over the network cannot trigger this.

libsoup prior to 3.6.2 is vulnerable to a null pointer dereference in soupmessageheadersgetcontentdisposition() . A malicious HTTP peer may crash a libsoup client or server that uses this function.

libsoup prior to 3.6.5 is vulnerable to out of bounds reads in soupheadersparserequest(). A maliciously-crafted HTTP request may crash the HTTP server.

libsoup's HTTP/2 server doesn't fully validate the values of the pseudo-headers :scheme, :authority, and :path. A client may crash the server by sending a malicious HTTP request.

libsoup prior to version 3.6.3 is vulnerable to a free of memory not on the heap in soupmessageheadersgetcontentdisposition(). A malicious HTTP client may induce memory corruption in the libsoup server.

Integer Underflow (Wraparound) vulnerability in the multipart message parser of the libsoup HTTP library. The flaw is caused by an unsafe arithmetic operation in the soupmultipartnewfrommessage() function. When a specially crafted multipart message is processed, the length calculation (end - 2 - split) can underflow, leading to invalid memory access and application crash. This can be exploited remotely without any authentication or user interaction, allowing attackers to disrupt the availability of applications or services using libsoup.

libsoup accepts duplicate Host: headers and implements a last-value-wins policy when soupmessageheadersgetone[common] is used to construct the request URI, while many proxies and routers use the first Host: header for routing. The provided PoC reliably demonstrates that a proxy honoring the first Host: can route to backend A but the libsoup server will interpret the request as for host B (last header), enabling virtual-host confusion and potential bypasses of host-based ACLs or cache poisoning.

A stack-based buffer overflow vulnerability exists in the md4sum() function of libsoup’s NTLM authentication module (SoupAuthNTLM). When NTLM authentication is enabled, insufficient bounds checking on stack-allocated buffers can allow a local attacker to overwrite adjacent memory. This may result in arbitrary code execution with the privileges of the affected application. Multiple widely deployed components, including WebKit, Evolution, GVfs, and gnome-online-accounts, enable NTLM by default, increasing exposure.

Stack-based buffer overflow vulnerability in libsoup’s multipart/form-data response parsing logic. The flaw exists in the soupfilterinputstreamreaduntil() function, where an incorrect length calculation may cause more data to be copied than the size of the caller-provided buffer. When a specially crafted multipart HTTP response is processed, libsoup can write past the end of a stack buffer, resulting in memory corruption. This issue can be triggered remotely without authentication or user interaction, potentially leading to application crashes or arbitrary code execution in applications that parse untrusted server responses.

A heap use-after-free vulnerability exists in libsoup's HTTP/2 client implementation. When a GNOME application sends an HTTP/2 POST request with a file body (using a non-pollable GInputStream such as GFileInputStream), the body data is read asynchronously via ginputstreamreadasync(). If the remote HTTP/2 server sends a GOAWAY frame while this async read is pending, the SoupHTTP2MessageDatastructure is freed through the shutdown path, but the async read callback ondataread() still fires afterward, accessing the freed heap memory.

This is a remotely-triggerable heap use-after-free — a malicious HTTP/2 server (or MITM attacker) can deterministically trigger it when any GNOME application uploads a file over HTTPS with HTTP/2. Affected applications include GNOME Web (Epiphany), GNOME Software, Flatpak, and any GLib-based application using SoupSession for HTTP/2 file uploads.

Impact type: Heap use-after-free (CWE-416) — the freed 168-byte SoupHTTP2MessageData struct is read after free, and the freed datasourcebuffer may also be written to by the still-pending async I/O operation. This constitutes memory corruption with potential for information disclosure or code execution.

A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soupfilterinputstreamreadline() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or user interaction by sending specially crafted chunked requests. This allows libsoup to parse and process multiple HTTP requests from a single network message, potentially leading to information disclosure.

WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ prior to version 2.20.0 or without libsoup 2.62.0, unexpectedly failed to use system proxy settings for WebSocket connections. As a result, users could be deanonymized by crafted web sites via a WebSocket connection.

A flaw was found in libsoup. An attacker who can control the input for the Content-Disposition header can inject CRLF (Carriage Return Line Feed) sequences into the header value. These sequences are then interpreted verbatim when the HTTP request or response is constructed, allowing arbitrary HTTP headers to be injected. This vulnerability can lead to HTTP header injection or HTTP response splitting without requiring authentication or user interaction.

A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access portions of server memory beyond the intended response. Exploitation requires a vulnerable configuration and access to a server using the embedded SoupServer component.

A flaw was found in libsoup's SoupServer HTTP Range header processing. The sortranges() comparator function in soup-message-headers.c returns the difference of two goffset (64-bit) values as an int (32-bit). When two range start positions in a multi-range request differ by more than INTMAX (~2.1 billion), the truncation flips the comparison result sign, violating qsort's ordering contract. The mis-sorted ranges are then incorrectly merged, causing the server to silently omit requested byte ranges from the HTTP 206 Partial Content response. A remote unauthenticated attacker can trigger this by sending a multi-range Range request for a resource larger than approximately 2 GB, with range start offsets more than INTMAX apart. The client receives fewer ranges than requested with no error indication, compromising data integrity for resumable downloads, delta updates, mirror synchronization, and chunked verification of large objects.

libsoup 2.32.2 and earlier does not validate certificates or clear the trust flag when the ssl-ca-file does not exist, which allows remote attackers to bypass authentication by connecting with a SSL connection.

Directory traversal vulnerability in soup-uri.c in SoupServer in libsoup before 2.35.4 allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in a URI.

GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain patterns of WebSocket data from clients.

libsoup prior to version 3.6.5 is vulnerable to a heap buffer over-read in the content sniffer's skipinsignificantwhitespace() function. libsoup clients may read one byte out of bounds in response to a crafted HTTP response sent by an HTTP server.

libsoup's appendparamquoted() function, prior to libsoup 3.6.1, contains an integer overflow bug resulting in buffer under-read, which may be triggered by sending an extremely large HTTP request to the libsoup server.

libsoup's SoupWebsocketConnection limits the size of incoming packets but not the size of WebSocket messages. A malicious peer may cause libsoup to allocate large amounts of memory by sending large messages consisting of many smaller packets.

libsoup's soupuridecodedatauri() function, prior to libsoup 3.6.1, may crash when processing a malformed data URI, resulting in denial of service.

libsoup prior to version 3.6.1 is vulnerable to heap buffer over-reads in the content sniffer's snifffeedorhtml() and skipinsignificantspace() functions. libsoup clients may read out of bounds in response to a crafted HTTP response sent by an HTTP server.

libsoup prior to version 3.6.1 is vulnerable to a heap buffer over-read in the content sniffer's sniffunknown() function. libsoup clients may read out of bounds in response to a crafted HTTP response sent by an HTTP server.