# Gnome Libsoup vulnerabilities Source: https://junglewise.ai/threats/technologies/libsoup Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/libsoup.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 43 vulnerabilities in Gnome Libsoup: 0 in the last 7 days and 10 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-103399, was published on 30 September 2026. Nothing in the last four weeks, down from 6 vulnerabilities in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 10 - All time: 43 (0 critical, 0 exploited in the wild) ## About Gnome Libsoup GNOME HTTP client/server library for use with GLIB applications. ## Latest Gnome Libsoup vulnerabilities - [CVE-2026-103399: libsoup HTTP request smuggling via undrained Expect: 100-continue body](https://junglewise.ai/threats/cve-2026-103399-a-flaw-was-found-in-soupserver-libsoup-when-an-http-1-x-client) (medium, CVSS 5.3, published 30 Sep 2026) - [CVE-2026-102560: libsoup heap buffer overflow in permessage-deflate WebSocket extension](https://junglewise.ai/threats/cve-2026-102560-a-flaw-was-found-in-libsoup-when-the-permessage-deflate) (high, CVSS 8.6, published 29 Sep 2026) - [CVE-2026-102558: libsoup heap buffer overflow in WebSocket handling](https://junglewise.ai/threats/cve-2026-102558-a-flaw-was-found-in-libsoup-when-max-incoming-payload-size-is) (high, CVSS 8.6, published 29 Sep 2026) - [CVE-2026-102555: libsoup out-of-bounds read in data-URI base64 decoding](https://junglewise.ai/threats/cve-2026-102555-a-flaw-was-found-in-libsoup-the-soup-uri-decode-data-uri) (high, CVSS 8.2, published 29 Sep 2026) - [CVE-2026-102557: libsoup heap corruption in WebSocket message reassembly](https://junglewise.ai/threats/cve-2026-102557-a-flaw-was-found-in-libsoup-when-reassembling-fragmented) (high, CVSS 8.6, published 29 Sep 2026) - [CVE-2026-102556: libsoup type confusion in WebSocket Pong signal](https://junglewise.ai/threats/cve-2026-102556-a-flaw-was-found-in-libsoup-when-handling-an-incoming-websocket) (high, CVSS 8.6, published 29 Sep 2026) - [CVE-2026-85534: libsoup HTTP/2 denial of service via buffer overflow in data callback](https://junglewise.ai/threats/cve-2026-85534-libsoup-http-2-denial-of-service-via-buffer-overflow-in-data) (medium, CVSS 5.9, published 4 Sep 2026) - [CVE-2026-85197: GNOME libsoup heap use-after-free in HTTP/2 client](https://junglewise.ai/threats/cve-2026-85197-gnome-libsoup-heap-use-after-free-in-http-2-client) (high, CVSS 7.6, published 4 Sep 2026) - [CVE-2026-77680: libsoup HTTP Range header algorithmic complexity denial of service](https://junglewise.ai/threats/cve-2026-77680-libsoup-http-range-header-algorithmic-complexity-denial-of) (medium, CVSS 5.3, published 25 Aug 2026) - [CVE-2026-77014: libsoup integer truncation in HTTP Range processing](https://junglewise.ai/threats/cve-2026-77014-libsoup-integer-truncation-in-http-range-processing) (medium, CVSS 5.3, published 20 Aug 2026) - [CVE-2026-66338: GNOME libsoup HTTP request smuggling in chunked transfer encoding parser](https://junglewise.ai/threats/cve-2026-66338-gnome-libsoup-http-request-smuggling-in-chunked-transfer-encoding) (medium, CVSS 5.4, published 24 Jul 2026) - [CVE-2026-66337: GNOME libsoup heap buffer over-read in soup_filter_input_stream_read_until](https://junglewise.ai/threats/cve-2026-66337-gnome-libsoup-heap-buffer-over-read-in-soup-filter-input-stream) (medium, CVSS 6.5, published 24 Jul 2026) - [CVE-2026-12548: GNOME libsoup heap out-of-bounds read in multipart HTTP parsing](https://junglewise.ai/threats/cve-2026-12548-gnome-libsoup-heap-out-of-bounds-read-in-multipart-http-parsing) (medium, CVSS 4.2, published 21 Jul 2026) - [CVE-2026-12547: GNOME libsoup information disclosure in SoupAuthManager proxy credential handling](https://junglewise.ai/threats/cve-2026-12547-gnome-libsoup-information-disclosure-in-soupauthmanager-proxy) (low, CVSS 3.4, published 21 Jul 2026) - [CVE-2026-15714: GNOME libsoup out-of-bounds read in multipart boundary processing](https://junglewise.ai/threats/cve-2026-15714-gnome-libsoup-out-of-bounds-read-in-multipart-boundary-processing) (medium, CVSS 6.5, published 14 Jul 2026) - [CVE-2026-15713: libsoup memory leak in HTTP/2 stream termination](https://junglewise.ai/threats/cve-2026-15713-libsoup-memory-leak-in-http-2-stream-termination) (medium, CVSS 5.9, published 14 Jul 2026) - [CVE-2026-15711: GNOME libsoup denial of service via oversized WebSocket control frame](https://junglewise.ai/threats/cve-2026-15711-gnome-libsoup-denial-of-service-via-oversized-websocket-control) (high, CVSS 7.5, published 14 Jul 2026) - [CVE-2026-15709: libsoup WebSocket unbounded decompression memory exhaustion](https://junglewise.ai/threats/cve-2026-15709-libsoup-websocket-unbounded-decompression-memory-exhaustion) (high, CVSS 7.5, published 14 Jul 2026) - [CVE-2026-15712: GNOME libsoup heap buffer over-read in HTTP/2 GOAWAY frame parsing](https://junglewise.ai/threats/cve-2026-15712-gnome-libsoup-heap-buffer-over-read-in-http-2-goaway-frame) (medium, CVSS 5.9, published 14 Jul 2026) - [CVE-2026-12478: GNOME libsoup out-of-bounds read in WebSocket frame processing](https://junglewise.ai/threats/cve-2026-12478-gnome-libsoup-out-of-bounds-read-in-websocket-frame-processing) (medium, CVSS 4.8, published 14 Jul 2026) - [CVE-2026-12549: GNOME libsoup buffer access error in Range header parsing](https://junglewise.ai/threats/cve-2026-12549-gnome-libsoup-buffer-access-error-in-range-header-parsing) (medium, CVSS 4.8, published 22 Jun 2026) - [CVE-2026-6324: GNOME libsoup HTTP request smuggling in soup_body_input_stream_read_chunked](https://junglewise.ai/threats/cve-2026-6324-gnome-libsoup-http-request-smuggling-in-soup-body-input-stream) (medium, CVSS 4.8, published 29 May 2026) - [CVE-2026-2708: A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The…](https://junglewise.ai/threats/cve-2026-2708-a-request-smuggling-vulnerability-exists-in-libsoup-s-http-1) (low, CVSS 3.7, published 23 Apr 2026) - [CVE-2026-5119: GNOME libsoup cleartext cookie disclosure in HTTPS proxy tunneling](https://junglewise.ai/threats/cve-2026-5119-gnome-libsoup-cleartext-cookie-disclosure-in-https-proxy-tunneling) (medium, CVSS 5.9, published 30 Mar 2026) - [CVE-2026-2436: A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the…](https://junglewise.ai/threats/cve-2026-2436-a-flaw-was-found-in-libsoup-s-soupserver-a-remote-attacker-could) (medium, CVSS 6.5, published 26 Mar 2026) ## Most severe Gnome Libsoup vulnerabilities - [CVE-2026-1761: GNOME libsoup stack-based buffer overflow in multipart response parsing](https://junglewise.ai/threats/cve-2026-1761-gnome-libsoup-stack-based-buffer-overflow-in-multipart-response) (high, CVSS 8.6, published 2 Feb 2026) - [CVE-2026-0719: GNOME libsoup stack buffer overflow in NTLM authentication](https://junglewise.ai/threats/cve-2026-0719-gnome-libsoup-stack-buffer-overflow-in-ntlm-authentication) (high, CVSS 8.6, published 8 Jan 2026) - [CVE-2026-102560: libsoup heap buffer overflow in permessage-deflate WebSocket extension](https://junglewise.ai/threats/cve-2026-102560-a-flaw-was-found-in-libsoup-when-the-permessage-deflate) (high, CVSS 8.6, published 29 Sep 2026) - [CVE-2026-102558: libsoup heap buffer overflow in WebSocket handling](https://junglewise.ai/threats/cve-2026-102558-a-flaw-was-found-in-libsoup-when-max-incoming-payload-size-is) (high, CVSS 8.6, published 29 Sep 2026) - [CVE-2026-102557: libsoup heap corruption in WebSocket message reassembly](https://junglewise.ai/threats/cve-2026-102557-a-flaw-was-found-in-libsoup-when-reassembling-fragmented) (high, CVSS 8.6, published 29 Sep 2026) - [CVE-2026-102556: libsoup type confusion in WebSocket Pong signal](https://junglewise.ai/threats/cve-2026-102556-a-flaw-was-found-in-libsoup-when-handling-an-incoming-websocket) (high, CVSS 8.6, published 29 Sep 2026) - [CVE-2025-14523: GNOME libsoup HTTP request smuggling via duplicate Host headers](https://junglewise.ai/threats/cve-2025-14523-gnome-libsoup-http-request-smuggling-via-duplicate-host-headers) (high, CVSS 8.2, published 11 Dec 2025) - [CVE-2026-102555: libsoup out-of-bounds read in data-URI base64 decoding](https://junglewise.ai/threats/cve-2026-102555-a-flaw-was-found-in-libsoup-the-soup-uri-decode-data-uri) (high, CVSS 8.2, published 29 Sep 2026) - [CVE-2026-85197: GNOME libsoup heap use-after-free in HTTP/2 client](https://junglewise.ai/threats/cve-2026-85197-gnome-libsoup-heap-use-after-free-in-http-2-client) (high, CVSS 7.6, published 4 Sep 2026) - [CVE-2025-11021: GNOME libsoup out-of-bounds read in cookie date handling](https://junglewise.ai/threats/cve-2025-11021-gnome-libsoup-out-of-bounds-read-in-cookie-date-handling) (high, CVSS 7.5, published 26 Sep 2025) ## Vulnerabilities per week Nothing in the last four weeks, down from 6 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 1 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 2 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 6 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Gnome technologies - [Gnome GLib](https://junglewise.ai/threats/technologies/glib): 18 vulnerabilities - [Gnome Libxslt](https://junglewise.ai/threats/technologies/libxslt): 7 vulnerabilities - [Gnome Gdk-Pixbuf](https://junglewise.ai/threats/technologies/gdk-pixbuf): 5 vulnerabilities - [Gnome GIMP](https://junglewise.ai/threats/technologies/gnome-gimp): 5 vulnerabilities - [Gnome Gvfs](https://junglewise.ai/threats/technologies/gvfs): 5 vulnerabilities - [Gnome Glib-Networking](https://junglewise.ai/threats/technologies/glib-networking): 4 vulnerabilities - [Gnome Localsearch](https://junglewise.ai/threats/technologies/localsearch): 4 vulnerabilities - [Gnome Epiphany](https://junglewise.ai/threats/technologies/epiphany): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Gnome Libsoup vulnerabilities", https://junglewise.ai/threats/technologies/libsoup, 9 November 2026.