Package "libsoup-3.0-common"
| Name: |
libsoup-3.0-common
|
Description: |
HTTP library implementation in C -- Common files
|
| Latest version: |
3.4.4-5ubuntu0.10 |
| Release: |
noble (24.04) |
| Level: |
security |
| Repository: |
main |
| Head package: |
libsoup3 |
| Homepage: |
https://wiki.gnome.org/Projects/libsoup |
Links
Download "libsoup-3.0-common"
Other versions of "libsoup-3.0-common" in Noble
Changelog
|
libsoup3 (3.4.4-5ubuntu0.10) noble-security; urgency=medium
* SECURITY UPDATE: Out-of-bounds read in soup_uri_decode_data_uri()
- debian/patches/CVE-2026-102555.patch: Decode with g_base64_decode_step
using the real buffer length in libsoup/soup-uri-utils.c
- CVE-2026-102555
* SECURITY UPDATE: Denial of service in SoupWebsocketConnection
- debian/patches/CVE-2026-102556.patch: Emit the pong signal with a
GBytes as declared in libsoup/websocket/soup-websocket-connection.c
- CVE-2026-102556
* SECURITY UPDATE: Denial of service in WebSocket.
- debian/patches/CVE-2026-10255X-pre1.patch: Add the oversized-message
error handler in libsoup/websocket/soup-websocket-connection.c
- debian/patches/CVE-2026-10255X-pre2.patch: Add the
wait_for_websocket_error() test helper in tests/websocket-test.c
- debian/patches/CVE-2026-10255X.patch: Cap message reassembly and
outgoing frames at the buffer limit in
libsoup/websocket/soup-websocket-connection.c
- debian/patches/CVE-2026-102558-12478.patch: Cap incoming frame payloads
at what the buffer can hold in
libsoup/websocket/soup-websocket-connection.c
- debian/patches/CVE-2026-102560.patch: Bound outgoing permessage-deflate
buffer growth in libsoup/websocket/soup-websocket-extension-deflate.c
- CVE-2026-102557
- CVE-2026-102558
- CVE-2026-102559
- CVE-2026-102560
- CVE-2026-12478
* SECURITY UPDATE: Request smuggling in Expect handling
- debian/patches/CVE-2026-103399.patch: Close the connection after an
early response in libsoup/server/http1/soup-server-message-io-http1.c
- CVE-2026-103399
* SECURITY UPDATE: Information disclosure in Proxy-Authorization handling
- debian/patches/CVE-2026-12547.patch: Scope cached proxy credentials to
the proxy they came from in libsoup/auth/soup-auth-manager.c.
- debian/patches/CVE-2026-12547-post1.patch: Pass cached proxy
credentials only within the same origin in
libsoup/auth/soup-auth-manager.c
- CVE-2026-12547
* SECURITY UPDATE: Denial of service in multipart parsing
- debian/patches/CVE-2026-12548.patch: Set a maximum size for the headers
buffer in libsoup/soup-headers.c and
libsoup/soup-message-headers-private.h
- CVE-2026-12548
* debian/patches/tests-Remove-unsupported-AuthDigestQop-none.patch: Remove
tests for unsupported AuthDigestQop directives in tests/httpd.conf.in.
* debian/patches/tests-Fix-flaky-test.patch: Fix race condition causing
intermittent test failures
-- Kyle Kernick Wed, 21 Oct 2026 15:56:52 -0600
|
| Source diff to previous version |
| CVE-2026-102555 |
A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when call |
| CVE-2026-102556 |
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray poin |
| CVE-2026-10255 |
A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is the function sell_stateme |
| CVE-2026-102558 |
A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an |
| CVE-2026-102560 |
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations us |
| CVE-2026-102557 |
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size aga |
| CVE-2026-102559 |
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray al |
| CVE-2026-12478 |
The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to- |
| CVE-2026-103399 |
A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer return |
| CVE-2026-12547 |
SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes |
| CVE-2026-12548 |
A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_heade |
|
|
libsoup3 (3.4.4-5ubuntu0.9) noble-security; urgency=medium
* SECURITY UPDATE: Use-after-free in HTTP/2 server
- debian/patches/CVE-2026-4271.patch: Protect message io while reading
and writing in libsoup/server/http2/soup-server-message-io-http2.c.
- CVE-2026-4271
* SECURITY UPDATE: Session hijacking in HTTP negotiation
- debian/patches/CVE-2026-5119.patch: Do not send cookies to a HTTP proxy
for a HTTPS request in libsoup/cookies/soup-cookie-jar.c.
- CVE-2026-5119
* SECURITY UPDATE: Control bypass in soup_body_input_stream_read_chunked
- debian/patches/CVE-2026-6324-pre1.patch: Close the connection after
responding to a request containing both Content-Length and
Transfer-Encoding in libsoup/server/http1/soup-server-message-io-http1.c
- debian/patches/CVE-2026-6324-1.patch: Improve parsing of chunked
request body in libsoup/http1/soup-body-input-stream.c and
libsoup/server/http1/soup-server-message-io-http1.c
- debian/patches/CVE-2026-6324-post1.patch: Limit buffer read to the
received content in libsoup/http1/soup-body-input-stream.c
- debian/patches/CVE-2026-6324-post2.patch: Fix OOB read when parsing
chunk size in libsoup/http1/soup-body-input-stream.c
- debian/patches/CVE-2026-6324-post3.patch: Require chunk-size to begin
with a hex digit in libsoup/http1/soup-body-input-stream.c
- CVE-2026-6324
* SECURITY UPDATE: Information disclosure via Proxy-Authorization header
- debian/patches/CVE-2026-66339.patch: Don't send Proxy-Authorization
through an established tunnel in libsoup/auth/soup-auth-manager.c
- CVE-2026-66339
* SECURITY UPDATE: Integer overflow and Denial of Service in HTTP Range
header processing.
- debian/patches/CVE-2026-77XXX.patch: Fix Range parsing overflows
and coalescing cost in libsoup/soup-message-headers-private.h and
libsoup/soup-message-headers.c
- CVE-2026-77014
- CVE-2026-77680
* SECURITY UPDATE: Use-after-free in HTTP/2 client implementation
- debian/patches/CVE-2026-85197-1.patch: Fix crash in on_data_read after
connection is destroyed in libsoup/http2/soup-client-message-io-http2.c
- debian/patches/CVE-2026-85197-2.patch: Keep reference to message
cancellable in libsoup/http2/soup-client-message-io-http2.c
- debian/patches/CVE-2026-85197-post1.patch: Fix cancellable leak in
libsoup/http2/soup-client-message-io-http2.c
- CVE-2026-85197
* SECURITY UPDATE: Denial of service in libsoup
- debian/patches/CVE-2026-85534.patch: Never send more body bytes than
nghttp2 requested in libsoup/http2/soup-client-message-io-http2.c
- CVE-2026-85534
-- Kyle Kernick Wed, 30 Sep 2026 13:59:51 -0600
|
| Source diff to previous version |
| CVE-2026-4271 |
A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server impleme |
| CVE-2026-5119 |
A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext |
| CVE-2026-6324 |
A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the `soup_body_input_stream_read_chunked()` fu |
| CVE-2026-66339 |
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header |
| CVE-2026-77014 |
A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subt |
| CVE-2026-77680 |
An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed |
| CVE-2026-85197 |
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the |
| CVE-2026-85534 |
A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the c |
|
|
libsoup3 (3.4.4-5ubuntu0.8) noble-security; urgency=medium
* SECURITY UPDATE: HTTP Request smuggling vulnerability
- debian/patches/CVE-2026-1801.patch: Use CRLF as line boundary when
parsing chunked encoding data in libsoup/http1/soup-body-input-
stream.c and tests/server-test.c.
- CVE-2026-1801
-- Kyle Kernick Tue, 15 Sep 2026 12:32:01 -0600
|
| Source diff to previous version |
| CVE-2026-1801 |
A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the so |
|
|
libsoup3 (3.4.4-5ubuntu0.7) noble-security; urgency=medium
* SECURITY UPDATE: Carriage Return Line Feed Injection
- debian/patches/CVE-2026-1467.patch: Do host validation when checking if
a GUri is valid
- debian/patches/CVE-2026-1536-pre1.patch: Reject duplicate host headers
- debian/patches/CVE-2026-1536.patch: Always validate the headers value
when coming from untrusted source
- CVE-2026-1467
- CVE-2026-1536
* SECURITY UPDATE: Information Leak
- debian/patches/CVE-2026-1539.patch: Also remove Proxy-Authorization
header on cross origin redirect
- CVE-2026-1539
-- Bruce Cable <email address hidden> Mon, 02 Feb 2026 15:38:57 +1100
|
| Source diff to previous version |
| CVE-2026-1467 |
A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF (Carriage Return Line Feed) Injection, occurs when an HTTP pro |
| CVE-2026-1536 |
A flaw was found in libsoup. An attacker who can control the input for the Content-Disposition header can inject CRLF (Carriage Return Line Feed) seq |
| CVE-2026-1539 |
A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTT |
|
|
libsoup3 (3.4.4-5ubuntu0.6) noble-security; urgency=medium
* SECURITY UPDATE: Use after free in HTTP/2 queues.
- debian/patches/CVE-2025-12105.patch: Add SOUP_MESSAGE_FINISHED checks in
libsoup/soup-session.c.
- CVE-2025-12105
-- Hlib Korzhynskyy <email address hidden> Thu, 11 Dec 2025 17:37:16 -0330
|
| CVE-2025-12105 |
A flaw was found in the asynchronous message queue handling of the libsoup library, widely used by GNOME and WebKit-based applications to manage HTTP |
|
About
-
Send Feedback to @ubuntu_updates
