CVE-2026-0719
High · 8.6CVSS
8.6
EPSS
0.6%
Published
Jan 8, 2026
CISA due date
—
The record
A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication. When processing extremely long passwords, an internal size calculation can overflow due to improper use of signed integers. This results in incorrect memory allocation on the stack, followed by unsafe memory copying. As a result, applications using libsoup may crash unexpectedly, creating a denial-of-service risk.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | libsoup | 0 | 3.4.4-150600.3.28.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | libsoup2 | 0 | 2.74.3-150600.4.19.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | libsoup | 0 | 2.62.2-5.26.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | libsoup | 0 | 3.4.4-150600.3.28.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | libsoup2 | 0 | 2.74.3-150600.4.19.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | libsoup | 0 | 2.62.2-5.26.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | libsoup | 0 | 3.4.4-150600.3.28.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | libsoup2 | 0 | 2.74.3-150600.4.19.1 |
| openSUSE:Leap 15.6 | libsoup | 0 | 3.4.4-150600.3.28.1 |
| openSUSE:Leap 15.6 | libsoup2 | 0 | 2.74.3-150600.4.19.1 |
| openSUSE:Leap 16.0 | libsoup | 0 | 3.6.5-160000.3.1 |
| openSUSE:Leap 16.0 | libsoup2 | 0 | 2.74.3-160000.4.1 |
| openSUSE:Tumbleweed | libsoup | 0 | 3.6.5-11.1 |
| openSUSE:Tumbleweed | libsoup2 | 0 | 2.74.3-14.1 |
Related vulnerabilities
- CVE-2026-2708 A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. Also affects libsoup
- CVE-2026-2369 A flaw was found in libsoup. Also affects libsoup
- CVE-2026-2443 A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. Also affects libsoup
- CVE-2026-1761 A flaw was found in libsoup. Also affects libsoup
- CVE-2026-1760 A flaw was found in SoupServer. Also affects libsoup
- CVE-2026-1539 A flaw was found in the libsoup HTTP library that can cause proxy authentication… Also affects libsoup
- CVE-2026-1536 A flaw was found in libsoup. Also affects libsoup
- CVE-2026-1467 A flaw was found in libsoup, an HTTP client library. Also affects libsoup