libsoup vulnerabilities

A use-after-free vulnerability was found in the libsoup library, in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server.

A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request.

In libsoup, when the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.

In libsoup, when constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.

In libsoup, when max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data.

In libsoup, the soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted data URI.

In libsoup, when reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash.

In libsoup, when handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.

A flaw was found in libsoup where sending an HTTP/2 request body from a non-pollable input stream can lead to buffering more data than the flow-control window allows. A malicious server can shrink SETTINGS_INITIAL_WINDOW_SIZE while the buffered read is in progress, causing the client to copy the full buffer into a smaller DATA callback without bounds check, potentially aborting the process or failing the HTTP/2 session.

A use-after-free vulnerability was found in libsoup's HTTP/2 client implementation. A malicious HTTP/2 server or MITM attacker can exploit it when a GNOME application uploads a file over HTTP/2 and the server sends a GOAWAY frame while the file body is being read asynchronously. This can lead to memory corruption, information disclosure, or arbitrary code execution.

An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. The coalescing loop uses O(N²) operations when many identical ranges are supplied, allowing CPU exhaustion. The issue is reachable server-side without authentication and can block the event loop for ~90 ms per request at the wire maximum.

In libsoup, in SoupServer's HTTP Range header processing, the sort_ranges() comparator truncates a 64-bit subtraction result to 32-bit int, causing incorrect sorting for ranges on files larger than ~2 GB. This leads to omission of requested ranges in HTTP 206 Partial Content responses.

In libsoup, after establishing a CONNECT tunnel through an HTTP proxy, the Proxy-Authorization header is incorrectly attached to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials.

In libsoup, the chunked transfer encoding parser uses a permissive parsing function that accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests.

In libsoup, an unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can send a crafted response, causing the client application to crash or disclose sensitive heap memory.

A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.

An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The soup_multipart_input_stream_read_headers() function does not properly restrict the size of boundary strings, leading to a read past the allocated buffer. A remote unauthenticated attacker can exploit this to cause a denial of service (DoS) or potentially read unauthorized memory fragments.

A vulnerability in libsoup's HTTP/2 implementation causes improper memory release under specific stream termination conditions, such as window exhaustion or explicit stream resets. A remote unauthenticated attacker acting as a malicious network peer can force the connection engine to allocate stream states that are subsequently leaked during cleanup. Over time, this leads to heap exhaustion and an Out-of-Memory (OOM) crash, resulting in a denial of service (DoS).

A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or less. A remote, unauthenticated attacker can exploit this by sending a non-compliant, oversized control frame, causing an internal processing crash and resulting in a remote denial of service (DoS) for applications utilizing libsoup WebSockets.

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The decompression loop processes data in chunks without enforcing an upper boundary limit on the output buffer size, allowing unbounded memory allocation. A remote, unauthenticated attacker can send a small, highly compressed payload (decompression bomb), causing an Out-of-Memory (OOM) crash and Denial of Service (DoS).

A heap buffer over-read vulnerability was discovered in libsoup versions 3.0 to 3.7.0 in the HTTP/2 GOAWAY frame handling. Missing length validation allows a remote unauthenticated attacker to send a malformed frame, causing application crash (DoS) or potential memory content leak.

The fix for CVE-2026-0716 in libsoup 3.6.6 (commit 6ff7ef0) placed the integer overflow guard only inside the masked frame block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.

A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the `soup_body_input_stream_read_chunked()` function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server.

libsoup contains a request smuggling vulnerability in its HTTP/1 header parsing logic. The soup_message_headers_append_common() function unconditionally appends header values without validating duplicate or conflicting Content-Length fields. This allows sending requests with multiple Content-Length headers of differing values.

A flaw was found in libsoup that allows sensitive session cookies to be transmitted in cleartext during the establishment of HTTPS tunnels through a configured HTTP proxy. Attackers can intercept these cookies, leading to potential session hijacking or user impersonation.

A stack-based buffer overflow vulnerability was found in the libsoup library during parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by sending a crafted multipart HTTP response, leading to memory corruption.

A flaw was found in libsoup’s WebSocket frame processing when handling incoming messages. If a non-default configuration is used where the maximum incoming payload size is unset, the library may read memory outside the intended bounds. This can cause unintended memory exposure or a crash. Applications using libsoup’s WebSocket support with this configuration may be impacted.

A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication. When processing extremely long passwords, an internal size calculation can overflow due to improper use of signed integers, resulting in incorrect memory allocation on the stack and unsafe memory copying. Applications using libsoup may crash unexpectedly, creating a denial-of-service risk.

A flaw in libsoup's HTTP header handling allows multiple Host: headers in a request, with the server processing the last one. Since front proxies often honor the first Host: header, this mismatch can cause vhost confusion.

A flaw was found in the asynchronous message queue handling of the libsoup library, used by GNOME and WebKit-based applications for HTTP/2 communications. When network operations are aborted at specific timing intervals, an internal message queue item may be freed twice due to missing state synchronization, leading to a use-after-free memory access. Attackers can remotely trigger this by sending specific HTTP/2 read and cancel sequences, causing a denial-of-service condition.

A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communication. When processing cookies with specially crafted expiration dates, the library may perform an out-of-bounds memory read.

A flaw was found in libsoup's caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information.

A vulnerability was found in the libsoup library due to its failure to correctly verify the termination of multipart HTTP messages. This allows a remote attacker to send a specially crafted multipart HTTP body, causing an out-of-bounds read.

A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. This may result in undefined behavior, allowing an attacker to bypass cookie expiration logic, causing persistent or unintended cookie behavior.

A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library. Processing specially crafted multipart messages causes an integer underflow, leading to invalid memory access and program crash.

A denial-of-service vulnerability has been found in the libsoup HTTP client library. It is triggered when a libsoup client receives a 401 (Unauthorized) HTTP response with a crafted domain parameter in the WWW-Authenticate header. Processing this malformed header can crash the client application using libsoup.

A flaw was found in the libsoup library in cookie handling. libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own.

A flaw in the libsoup library causes HTTP clients to mistakenly send the Authorization header to the new host during a redirect. This allows the new host to impersonate the user to the original server.

A flaw was found in the libsoup library causing memory leaks in the soup_header_parse_quality_list() function when parsing a quality list containing elements with all zeroes.

A vulnerability was found in the libsoup library in the soup_multipart_new_from_message() function, allowing an out-of-bounds read. A malicious HTTP client can exploit this flaw to force the libsoup server to read memory outside the allocated buffer.

A NULL pointer dereference vulnerability was found in the SoupAuthDigest authentication mechanism of the libsoup library. A malicious HTTP server can exploit this flaw to crash the libsoup client.

A flaw was found in libsoup, where soup_auth_digest_authenticate() is vulnerable to a NULL pointer dereference. This issue may cause the libsoup client to crash.

A flaw was found in libsoup's SoupContentSniffer, specifically in the sniff_mp4 function, which may cause a NULL pointer dereference. A malicious HTTP server can exploit this to crash the libsoup client.

A flaw was found in libsoup, where the soup_message_headers_get_content_disposition() function is vulnerable to a NULL pointer dereference. This allows a malicious HTTP peer to crash a libsoup client or server using this function.

A vulnerability was found in the libsoup library's HTTP/2 server implementation. The server does not fully validate the values of the :scheme, :authority, and :path pseudo-headers, which may allow an attacker to cause a Denial of Service (DoS).

A flaw was found in the libsoup library in the implementation of HTTP range requests. It allows a malicious client to request the same range multiple times in a single HTTP request, causing excessive memory consumption on the server. This vulnerability does not enable a full denial of service.

A vulnerability was found in the libsoup library, where the soup_headers_parse_request() function may be vulnerable to an out-of-bounds read. This allows an attacker to crash the HTTP server using a specially crafted HTTP request.

A flaw was found in the libsoup library in the sniff_feed_or_html() and skip_insignificant_space() functions, which may lead to a heap buffer over-read.

A flaw was found in the libsoup library in the sniff_unknown() function, which may lead to a heap buffer over-read. This vulnerability could allow an attacker to read sensitive data from memory.

A flaw was found in the libsoup library in the soup_uri_decode_data_uri() function, which may crash when processing malformed data URIs. This vulnerability allows an attacker to cause a denial of service (DoS).