CVE-2026-2443
Medium · 5.3CVSS
5.3
EPSS
0.5%
Published
Feb 13, 2026
CISA due date
—
The record
A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access portions of server memory beyond the intended response. Exploitation requires a vulnerable configuration and access to a server using the embedded SoupServer component.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise Micro 5.3 | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise Micro 5.4 | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise Micro 5.5 | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | libsoup | 0 | 3.4.4-150600.3.34.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | libsoup2 | 0 | 2.74.3-150600.4.27.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | libsoup | 0 | 3.4.4-150600.3.34.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | libsoup2 | 0 | 2.74.3-150600.4.27.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | libsoup | 0 | 3.4.4-150600.3.34.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | libsoup2 | 0 | 2.74.3-150600.4.27.1 |
| SUSE:Linux Micro 6.0 | libsoup | 0 | 3.4.2-13.1 |
| openSUSE:Leap 15.6 | libsoup | 0 | 3.4.4-150600.3.34.1 |
| openSUSE:Leap 15.6 | libsoup2 | 0 | 2.74.3-150600.4.27.1 |
| openSUSE:Leap 16.0 | libsoup | 0 | 3.6.6-160000.1.1 |
| openSUSE:Leap 16.0 | libsoup2 | 0 | 2.74.3-160000.4.1 |
| openSUSE:Tumbleweed | libsoup | 0 | 3.6.5-13.1 |
| openSUSE:Tumbleweed | libsoup2 | 0 | 2.74.3-16.1 |
Related vulnerabilities
- CVE-2026-2708 A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. Also affects libsoup2
- CVE-2026-2369 A flaw was found in libsoup. Also affects libsoup2
- CVE-2026-1760 A flaw was found in SoupServer. Also affects libsoup2
- CVE-2026-1539 A flaw was found in the libsoup HTTP library that can cause proxy authentication… Also affects libsoup2
- CVE-2026-1467 A flaw was found in libsoup, an HTTP client library. Also affects libsoup2
- CVE-2024-52531 GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform… Also affects libsoup2
- CVE-2024-52532 GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. Also affects libsoup2
- CVE-2024-52530 GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because… Also affects libsoup2