Red Hat libsoup CVE-2026-2443 Out-of-Bounds Read Vulnerability Advisory

Critical Vulnerability Information Vulnerability Overview CVE ID: CVE-2026-2443 Publication Date: February 13, 2026 CVSS v3 Base Score: 5.3 Severity: Low Vulnerability Description A flaw has been identified in libsoup, an HTTP library widely used in GNOME systems. When processing specially crafted HTTP Range headers, this library may incorrectly validate the requested byte range. Under certain build configurations, this could allow a remote attacker to access portions of server memory beyond the intended response scope. Exploitation of this vulnerability requires a vulnerable configuration and access to the server via the embedded SoupServer component. Related Statements This issue has limited impact. An out-of-bounds read vulnerability in libsoup, triggered during HTTP Range header processing, could lead to heap information disclosure. Although upstream exploitation might allow leakage of heap memory contents, Red Hat does not build GLib with G_DISABLE_CHECKS, which prevents the creation of out-of-bounds byte slices in supported products. Consequently, the risk of leaking meaningful information in shipping configurations is limited. This issue primarily affects applications using the SoupServer component that do not handle untrusted HTTP Range headers. Mitigation Mitigations for this issue may not be available, or currently available options do not meet Red Hat product security standards, including ease of use and deployment, applicability across a broad installation base, or stability. Affected Packages and Published Red Hat Security Advisories Red Hat Enterprise Linux 10: libsoup3 (Fix deferred) Red Hat Enterprise Linux 6: libsoup (Fix deferred) Red Hat Enterprise Linux 7: libsoup (Fix deferred) Red Hat Enterprise Linux 8: libsoup (Fix deferred) Red Hat Enterprise Linux 9: libsoup (Fix deferred) Weakness (CWE) CWE-125: Out-of-bounds read Confidentiality: Attackers may obtain secret values, such as encryption keys, PII, memory addresses, or other information usable for further attacks. Bypass of Confidentiality Mechanisms: Out-of-bounds memory may contain memory addresses or other information that can be used to bypass protection mechanisms like ASLR, thereby increasing the reliability of exploiting code execution vulnerabilities. Availability: Segmentation faults or crashes could lead to DoS, termination, or system restarts. Other: Read operations may result in other undefined or unintended consequences. Acknowledgments Red Hat thanks Codean Labs for reporting this issue.

Goal Reached Thanks to every supporter — we hit 100%!

Red Hat libsoup CVE-2026-2443 Out-of-Bounds Read Vulnerability Advisory

More from this source