CVE-2026-77680: libsoup HTTP Range header algorithmic complexity denial of service

CVE-2026-77680 · Severity: medium · CVSS 5.3 · Published 2026-08-25

libsoup is a widely-used HTTP library used in web servers and applications. A flaw in how it processes HTTP Range requests can cause excessive CPU consumption when a client sends a specially-crafted request with thousands of identical range specifications. This can block server processing and cause a denial of service, though no data is exposed or corrupted.

Technologies: Gnome Libsoup. Vendors: Gnome.

Quick answers

Is CVE-2026-77680 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77680 being exploited in the wild.
How severe is CVE-2026-77680?
Medium severity, with a CVSS score of 5.3, published 25 August 2026.
Which products and versions are affected?
Gnome Libsoup versions containing CVE-2025-32907 fix but prior to MR !550 (before 2026-08-20).
Is there a fix for CVE-2026-77680?
A patch was published on 2026-08-20: MR !550 merged Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77680 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-77680?
Check whether you run Gnome Libsoup at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An algorithmic complexity vulnerability exists in libsoup's HTTP Range header coalescing logic in soup_message_headers_get_ranges_internal(). The vulnerable code uses g_array_remove_index() in a loop to coalesce identical ranges, which performs O(N) memmove operations for each removal on the contiguous GArray, resulting in O(N²) overall complexity. The flaw is reachable server-side when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required. An attacker can send an HTTP request with up to ~25,000 identical ranges (e.g., bytes=0-0 repeated) within the ~100 KiB header size limit, consuming ~90 ms of single-core CPU per request and blocking the server's event loop. The fix, merged in upstream MR !550 (2026-08-20), replaces per-element removal with O(N) in-place compaction and enforces a 200-range limit per request.

Affected products

  • GNOME libsoup versions containing CVE-2025-32907 fix but prior to MR !550 (before 2026-08-20)

Timeline

  • 2026-08-25: disclosed
  • 2026-08-20: patched: MR !550 merged

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.