What’s Vulnerable › Products
GNOME libsoup vulnerabilities
36 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 30 published in the last 12 months.
Check whether your GNOME libsoup version is affected
Latest GNOME libsoup vulnerabilities
- CVE-2026-102560 — Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth (CVSS 9.8)
- CVE-2026-102559 — Libsoup: libsoup: heap buffer overflow during websocket client-frame masking (CVSS 8.6)
- CVE-2026-102558 — Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth (CVSS 8.6)
- CVE-2026-102555 — Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decoding (CVSS 8.2)
- CVE-2026-102557 — Libsoup: libsoup: heap buffer overflow during websocket message reassembly (CVSS 8.6)
- CVE-2026-102556 — Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion (CVSS 8.6)
- CVE-2026-66339 — Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels (CVSS 6.5)
- CVE-2026-66338 — Libsoup: libsoup: http request smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked() (CVSS 7.2)
- CVE-2026-66337 — Libsoup: libsoup: heap buffer over-read via integer underflow in soup_filter_input_stream_read_until() (CVSS 6.5)
- CVE-2026-12548 — Libsoup: heap out-of-bounds read in libsoup due to integer truncation (CVSS 4.2)
- CVE-2026-12549 — Libsoup: incomplete fix for cve-2026-2443: range suffix overflow in libsoup soupserver (CVSS 4.8)
- CVE-2026-2708 — Libsoup: libsoup: http request smuggling via duplicate content-length headers (CVSS 5.3)
- CVE-2026-5119 — Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment (CVSS 8.2)
- CVE-2026-2436 — Libsoup: libsoup: denial of service via use-after-free in soupserver during tls handshake (CVSS 8.2)
- CVE-2026-2369 — Libsoup: libsoup: buffer overread due to integer underflow when handling zero-length resources (CVSS 9.1)
- CVE-2026-4271 — Libsoup: libsoup: denial of service via use-after-free in http/2 server (CVSS 7.5)
- CVE-2026-3634 — Libsoup: libsoup: http header injection and response splitting via crlf injection in content-type header (CVSS 6.5)
- CVE-2026-3633 — Libsoup: libsoup: header and http request injection via crlf injection (CVSS 6.5)
- CVE-2026-3632 — Libsoup: libsoup: http smuggling and server-side request forgery via malformed hostnames (CVSS 5.5)
- CVE-2026-3099 — Libsoup: libsoup: authentication bypass via digest authentication replay attack (CVSS 7.3)
- CVE-2026-2443 — Libsoup: out-of-bounds read in libsoup handle_partial_get() leading to heap information disclosure (CVSS 5.3)
- CVE-2026-1801 — Libsoup: libsoup: http request smuggling via malformed chunk headers (CVSS 6.5)
- CVE-2026-1539 — Libsoup: libsoup: credential leakage via http redirects (CVSS 5.8)
- CVE-2026-1536 — Libsoup: libsoup: http header injection or response splitting via crlf injection in content-disposition header (CVSS 5.3)
- CVE-2026-1467 — Libsoup: libsoup: http header injection via specially crafted urls when an http proxy is configured (CVSS 5.3)