CVE-2026-1761
High · 8.6CVSS
8.6
EPSS
1.1%
Published
Feb 2, 2026
CISA due date
—
The record
A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by sending a specially crafted multipart HTTP response, which can lead to memory corruption. This issue may result in application crashes or arbitrary code execution in applications that process untrusted server responses, and it does not require authentication or user interaction.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Micro 5.2 | libsoup | 0 | 2.68.4-150200.4.24.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | libsoup | 0 | 3.4.4-150600.3.31.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | libsoup2 | 0 | 2.74.3-150600.4.24.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | libsoup | 0 | 2.62.2-5.29.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | libsoup | 0 | 3.4.4-150600.3.31.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | libsoup2 | 0 | 2.74.3-150600.4.24.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | libsoup | 0 | 2.62.2-5.29.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | libsoup | 0 | 3.4.4-150600.3.31.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | libsoup2 | 0 | 2.74.3-150600.4.24.1 |
| openSUSE:Leap 15.6 | libsoup | 0 | 3.4.4-150600.3.31.1 |
| openSUSE:Leap 15.6 | libsoup2 | 0 | 2.74.3-150600.4.24.1 |
| openSUSE:Leap 16.0 | libsoup | 0 | 3.6.5-160000.4.1 |
| openSUSE:Leap 16.0 | libsoup2 | 0 | 2.74.3-160000.3.1 |
| openSUSE:Tumbleweed | libsoup | 0 | 3.6.5-12.1 |
| openSUSE:Tumbleweed | libsoup2 | 0 | 2.74.3-15.1 |
Related vulnerabilities
- CVE-2026-1760 A flaw was found in SoupServer. Also affects libsoup
- CVE-2026-1539 A flaw was found in the libsoup HTTP library that can cause proxy authentication… Also affects libsoup
- CVE-2026-1467 A flaw was found in libsoup, an HTTP client library. Also affects libsoup
- CVE-2026-0716 A flaw was found in libsoup’s WebSocket frame processing when handling incoming messages. Also affects libsoup
- CVE-2024-52531 GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform… Also affects libsoup
- CVE-2024-52532 GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. Also affects libsoup
- CVE-2024-52530 GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because… Also affects libsoup
- CVE-2026-2708 A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. Also affects libsoup