Executive brief
libsoup is an HTTP client/server library used by many Linux applications and services. A flaw in its handling of HTTP Range requests (used for downloading partial files) causes it to silently omit requested byte ranges when responding to partial-content requests on files larger than 2 GB. An attacker could exploit this to cause incomplete file transfers, potentially delivering corrupted or incomplete data to users.
Technical details
An integer truncation vulnerability (CWE-197) exists in the sort_ranges() comparator function in soup-message-headers.c. A 64-bit subtraction result is truncated to a 32-bit integer, causing sign flips when range offsets differ by more than INT_MAX. This affects HTTP 206 Partial Content responses for resources larger than ~2 GB. The vulnerability is network-reachable and requires no authentication or user interaction; it only manifests when serving large files. The attacker can cause silent omission of requested byte ranges from server responses. A fix is available in the upstream GNOME libsoup project (merge request #550).
Affected products
- GNOME libsoup <unknown>
Timeline
- 2026-08-20: disclosed