Vulnerability feed

Executive summary

Several security flaws were fixed in libsoup3, a networking library used by applications on Ubuntu 26.10. The advisory says the issues could allow denial of service, disclosure of sensitive information, security control bypass, or possibly code execution, but it does not give an overall severity rating. Ubuntu recommends updating libsoup3 to the fixed version delivered for Ubuntu 26.10.

Technical summary

The advisory describes several flaws in libsoup's handling of HTTP/2 requests and transfers, HTTPS proxy connections, chunked HTTP requests, proxy authentication credentials, and HTTP Range headers. Attackers are described as remote, and the advisory says the impacts range from denial of service to information disclosure, security control bypass, and possibly arbitrary code execution for one HTTP/2 connection issue (CVE-2026-85197). The advisory does not state the exact vulnerability classes, CVSS scores, or the specific package version numbers that fix the issues. It also does not state workarounds or detection guidance. The advisory says the fixes apply to libsoup3 on Ubuntu 26.10, and it notes that several issues only affected Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

Affects

CanonicallibsoupCanonical Ubuntu LinuxCanonical UbuntuCanonical libsoup3libsoup