A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication. When processing extremely long passwords, an internal size calculation can overflow due to improper use of signed integers. This results in incorrect memory allocation on the stack, followed by unsafe memory copying. As a result, applications using libsoup may crash unexpectedly, creating a denial-of-service risk.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libsoupUpgrade libsoup-devel | Feb 10, 2026 | Feb 9, 2026 |
| Amazon Linux Ami 2 | — | Upgrade libsoup-develUpgrade libsoup-debuginfoUpgrade libsoup | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade libsoup3-debugsourceUpgrade libsoup-debugsourceUpgrade libsoup3-docUpgrade libsoup-develUpgrade libsoup3-debuginfoUpgrade libsoupUpgrade libsoup-docUpgrade libsoup-debuginfoUpgrade libsoup3-develUpgrade libsoup3 | Feb 10, 2026 | Jan 8, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libsoupUpgrade libsoup-help | Mar 17, 2026 | Mar 16, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade libsoupUpgrade libsoup-help | Mar 10, 2026 | Mar 10, 2026 |
| Oracle_linux | — | Upgrade libsoupUpgrade libsoup-develUpgrade libsoup3Upgrade libsoup3-develUpgrade libsoup3-doc | Feb 9, 2026 | Jan 8, 2026 |
| Redhat_linux | — | Upgrade libsoup-develUpgrade libsoup3-docUpgrade libsoupUpgrade libsoup-debugsourceUpgrade libsoup3-develUpgrade libsoup3Upgrade libsoup3-debuginfoUpgrade libsoup-debuginfoUpgrade spice-client-win-x86Upgrade spice-client-win-x64Upgrade libsoup3-debugsourceNo solution exists | Feb 6, 2026 | Jan 8, 2026 |
| Rocky_linux | — | Upgrade libsoup3-develUpgrade libsoup-debugsourceUpgrade libsoupUpgrade libsoup-develUpgrade libsoup3Upgrade libsoup-debuginfoUpgrade libsoup3-debugsourceUpgrade libsoup3-debuginfo | Feb 9, 2026 | Feb 7, 2026 |
| Suse | — | Upgrade libsoup-2_4-1Upgrade libsoup-develUpgrade typelib-1_0-Soup-3_0Upgrade libsoup-2_4-1-32bitUpgrade libsoup-3_0-0Upgrade libsoup-3_0-0-32bitUpgrade typelib-1_0-Soup-2_4Upgrade libsoup2-develUpgrade libsoup2-langUpgrade libsoup2-devel-32bitUpgrade libsoup-devel-32bitUpgrade libsoup-lang | Jan 23, 2026 | Jan 19, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub