CVE-2026-2369
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Mar 19, 2026
CISA due date
—
The record
A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This can allow an attacker to potentially access sensitive information or cause an application level denial of service.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise Micro 5.3 | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise Micro 5.4 | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise Micro 5.5 | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | libsoup | 0 | 3.4.4-150600.3.34.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | libsoup2 | 0 | 2.74.3-150600.4.27.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | libsoup | 0 | 3.4.4-150600.3.34.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | libsoup2 | 0 | 2.74.3-150600.4.27.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | libsoup | 0 | 3.4.4-150600.3.34.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | libsoup2 | 0 | 2.74.3-150600.4.27.1 |
| SUSE:Linux Micro 6.0 | libsoup | 0 | 3.4.2-13.1 |
| openSUSE:Leap 15.6 | libsoup | 0 | 3.4.4-150600.3.34.1 |
| openSUSE:Leap 15.6 | libsoup2 | 0 | 2.74.3-150600.4.27.1 |
| openSUSE:Leap 16.0 | libsoup | 0 | 3.6.6-160000.1.1 |
| openSUSE:Leap 16.0 | libsoup2 | 0 | 2.74.3-160000.4.1 |
| openSUSE:Tumbleweed | libsoup | 0 | 3.6.5-13.1 |
| openSUSE:Tumbleweed | libsoup2 | 0 | 2.74.3-16.1 |
Related vulnerabilities
- CVE-2026-2708 A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. Also affects libsoup2
- CVE-2026-2443 A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. Also affects libsoup2
- CVE-2026-1760 A flaw was found in SoupServer. Also affects libsoup2
- CVE-2026-1539 A flaw was found in the libsoup HTTP library that can cause proxy authentication… Also affects libsoup2
- CVE-2026-1467 A flaw was found in libsoup, an HTTP client library. Also affects libsoup2
- CVE-2024-52531 GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform… Also affects libsoup2
- CVE-2024-52532 GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. Also affects libsoup2
- CVE-2024-52530 GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because… Also affects libsoup2