Gnome Libsoup
26 CVEs affecting Gnome Libsoup. Latest disclosed: 2026-06-22. Critical: 3, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-17266 | Critical | 9.8 | 2019-10-06 | libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soup_ntlm_parse_challenge() in soup-auth-ntlm.c does not properly check an… |
CVE-2018-12910 | Critical | 9.8 | 2018-07-05 | The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname. |
CVE-2017-2885 | Critical | 9.8 | 2018-04-24 | An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resultin… |
CVE-2025-12105 | High | 7.5 | 2025-10-23 | A flaw was found in the asynchronous message queue handling of the libsoup library, widely used by GNOME and WebKit-based applications to manage HTTP/2 communi… |
CVE-2024-52532 | High | 7.5 | 2024-11-11 | GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain patterns of WebSocket data from clients. |
CVE-2024-52530 | High | 7.5 | 2024-11-11 | GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transf… |
CVE-2025-2784 | High | 7.0 | 2025-04-03 | A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup cli… |
CVE-2026-2436 | Medium | 6.5 | 2026-03-26 | A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees co… |
CVE-2026-2369 | Medium | 6.5 | 2026-03-19 | A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This… |
CVE-2024-52531 | Medium | 6.5 | 2024-11-11 | GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_parse_param_list_strict. There is a plausib… |
CVE-2018-11713 | Medium | 6.5 | 2018-06-04 | WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ prior to version 2.20.0 or without… |
CVE-2026-5119 | Medium | 5.9 | 2026-03-30 | A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the… |
CVE-2026-3099 | Medium | 5.8 | 2026-03-12 | A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or en… |
CVE-2026-1539 | Medium | 5.8 | 2026-01-28 | A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTTP redirect… |
CVE-2026-1536 | Medium | 5.8 | 2026-01-28 | A flaw was found in libsoup. An attacker who can control the input for the Content-Disposition header can inject CRLF (Carriage Return Line Feed) sequences int… |
CVE-2026-1467 | Medium | 5.8 | 2026-01-27 | A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF (Carriage Return Line Feed) Injection, occurs when an HTTP proxy is conf… |
CVE-2026-4271 | Medium | 5.3 | 2026-03-17 | A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A… |
CVE-2026-2443 | Medium | 5.3 | 2026-02-13 | A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may impr… |
CVE-2026-1801 | Medium | 5.3 | 2026-02-03 | A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_… |
CVE-2026-12549 | Medium | 4.8 | 2026-06-22 | The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client se… |