CVE-2026-2369: Libsoup: libsoup: buffer overread due to integer underflow when handling zero-length resources

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-19 · updated 2026-06-17
Weakness: CWE-191

Description

A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This can allow an attacker to potentially access sensitive information or cause an application level denial of service.

Affected products

GNOME libsoup: all versions

References

https://access.redhat.com/security/cve/CVE-2026-2369
https://bugzilla.redhat.com/show_bug.cgi?id=2439091
https://gitlab.gnome.org/GNOME/libsoup/-/issues/498

Get alerted when CVE-2026-2369 or the next vulnerability affects your stack