GNOME libsoup

An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability.

The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname.

libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soup_ntlm_parse_challenge() in soup-auth-ntlm.c does not properly check an NTLM message's length before proceeding with a memcpy.

Libsoup: libsoup: buffer overread due to integer underflow when handling zero-length resources

GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_parse_param_list_strict. There is a plausible way to reach this remotely via soup_message_headers_get_content_type (e.g., an application may want to retrieve the content type of a request or response).

Libsoup: libsoup: denial of service via use-after-free in soupserver during tls handshake

Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment

Libsoup: libsoup: denial of service via use-after-free in http/2 server

GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain patterns of WebSocket data from clients.

GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is treated the same as a "Transfer-Encoding: chunked" header.

Libsoup: libsoup: authentication bypass via digest authentication replay attack

Libsoup: libsoup: http request smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked()

Libsoup: heap buffer over-read in `skip_insignificant_space` when sniffing content

WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ prior to version 2.20.0 or without libsoup 2.62.0, unexpectedly failed to use system proxy settings for WebSocket connections. As a result, users could be deanonymized by crafted web sites via a WebSocket connection.

Libsoup: libsoup: http request smuggling via malformed chunk headers

Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels

Libsoup: libsoup: heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()

Libsoup: libsoup: header and http request injection via crlf injection

Libsoup: libsoup: http header injection and response splitting via crlf injection in content-type header

Libsoup: libsoup: http header injection via specially crafted urls when an http proxy is configured

Libsoup: libsoup: http header injection or response splitting via crlf injection in content-disposition header

Libsoup: libsoup: credential leakage via http redirects

Libsoup: libsoup: http smuggling and server-side request forgery via malformed hostnames

Libsoup: out-of-bounds read in libsoup handle_partial_get() leading to heap information disclosure

Libsoup: libsoup: http request smuggling via duplicate content-length headers

Directory traversal vulnerability in soup-uri.c in SoupServer in libsoup before 2.35.4 allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in a URI.

libsoup 2.32.2 and earlier does not validate certificates or clear the trust flag when the ssl-ca-file does not exist, which allows remote attackers to bypass authentication by connecting with a SSL connection.

Libsoup: incomplete fix for cve-2026-2443: range suffix overflow in libsoup soupserver

Libsoup: heap out-of-bounds read in libsoup due to integer truncation