A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication. When processing extremely long passwords, an internal size calculation can overflow due to improper use of signed integers. This results in incorrect memory allocation on the stack, followed by unsafe memory copying. As a result, applications using libsoup may crash unexpectedly, creating a denial-of-service risk.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libsoup-develUpgrade libsoup | Feb 10, 2026 | Feb 9, 2026 |
| Amazon Linux Ami 2 | — | Upgrade libsoup-debuginfoUpgrade libsoupUpgrade libsoup-devel | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade libsoup3-debugsourceUpgrade libsoup3-docUpgrade libsoup-debugsourceUpgrade libsoup3-develUpgrade libsoupUpgrade libsoup-docUpgrade libsoup-debuginfoUpgrade libsoup3-debuginfoUpgrade libsoup-develUpgrade libsoup3 | Feb 10, 2026 | Jan 8, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libsoup-helpUpgrade libsoup | Mar 17, 2026 | Mar 16, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade libsoupUpgrade libsoup-help | Mar 10, 2026 | Mar 10, 2026 |
| Oracle_linux | — | Upgrade libsoup3-develUpgrade libsoup3-docUpgrade libsoup3Upgrade libsoup-develUpgrade libsoup | Feb 9, 2026 | Jan 8, 2026 |
| Redhat_linux | — | Upgrade libsoup-debugsourceUpgrade libsoup3-docUpgrade libsoup-develUpgrade libsoupUpgrade libsoup3Upgrade spice-client-win-x64Upgrade spice-client-win-x86Upgrade libsoup3-debugsourceNo solution existsUpgrade libsoup3-develUpgrade libsoup3-debuginfoUpgrade libsoup-debuginfo | Feb 6, 2026 | Jan 8, 2026 |
| Rocky_linux | — | Upgrade libsoup3-debugsourceUpgrade libsoup-develUpgrade libsoup3-debuginfoUpgrade libsoup-debuginfoUpgrade libsoup3Upgrade libsoupUpgrade libsoup3-develUpgrade libsoup-debugsource | Feb 9, 2026 | Feb 7, 2026 |
| Suse | — | Upgrade libsoup-devel-32bitUpgrade libsoup-langUpgrade typelib-1_0-Soup-3_0Upgrade libsoup2-develUpgrade libsoup-3_0-0-32bitUpgrade libsoup-3_0-0Upgrade libsoup-2_4-1-32bitUpgrade typelib-1_0-Soup-2_4Upgrade libsoup2-devel-32bitUpgrade libsoup2-langUpgrade libsoup-develUpgrade libsoup-2_4-1 | Jan 23, 2026 | Jan 19, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub