Executive brief
libsoup, a widely used networking library for GNOME and Linux applications, contains a flaw in how it handles multi-part web responses. A malicious server can send a specially crafted response that causes an application using this library to crash or potentially leak small fragments of its memory. This could lead to a service outage for affected software or the exposure of sensitive internal data.
Technical details
An out-of-bounds read exists in libsoup's `soup_multipart_input_stream_read_headers()` function within `soup-multipart-input-stream.c`. The vulnerability is caused by a lack of length validation when performing a `strncmp()` comparison between a partially-buffered line (`meta_buf`) and an attacker-controlled multipart boundary string. A remote, unauthenticated attacker can provide an oversized boundary parameter in a `Content-Type` header and send the response body in specific chunks to force the library to read past the allocated buffer. This can result in a heap-buffer-overflow, leading to an application crash (DoS) or potential information disclosure of adjacent memory contents.
Affected products
- GNOME libsoup 3.7.0
- Red Hat Red Hat Enterprise Linux 8 affected
- Red Hat Red Hat Enterprise Linux 9 affected
- Red Hat Red Hat Enterprise Linux 10 affected
Timeline
- 2026-02-12: disclosed: Reported via YesWeHack to GNOME libsoup maintainers
- 2026-07-14: advisory: CVE published and Red Hat advisory issued