CVE-2026-12549: HTTP Range Request DoS Vulnerability

CVE-2026-12549 Overview

CVE-2026-12549 is a regression of the earlier fix for CVE-2026-2443 in the libsoup HTTP client/server library. A subsequent rework commit replaced specific overflow checks with a general signed comparison, reintroducing improper boundary handling [CWE-805]. When a client sends an HTTP Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped. The server then emits malformed HTTP 206 Partial Content responses and floods logs with error messages. The flaw allows a remote unauthenticated attacker to degrade service availability through repeated malformed Range requests.

Critical Impact
A remote attacker can trigger malformed HTTP 206 responses and excessive log generation by sending crafted Range requests, leading to log flooding and potential denial of service against libsoup-based servers.

Affected Products

GNOME libsoup HTTP library
Red Hat distributions shipping affected libsoup versions
Applications and services that depend on libsoup for HTTP serving

Discovery Timeline

2026-06-22 - CVE-2026-12549 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-12549

Vulnerability Analysis

The vulnerability resides in the HTTP Range request handling logic of libsoup. RFC 7233 allows a client to request a suffix of a resource using the Range: bytes=-N syntax, where N specifies the number of bytes from the end of the entity. When N is larger than the total content length, the server must clamp the start position to zero.

The original fix for CVE-2026-2443 introduced specific overflow checks to handle this scenario. A later refactoring commit replaced those targeted checks with a single signed comparison, which fails to catch the case where subtraction produces a negative start offset. The negative value propagates into the response construction, producing malformed HTTP 206 Partial Content headers.

Root Cause

The root cause is improper boundary handling during the rework of Range header parsing. The generalized signed comparison does not detect that content_length - suffix_length produces a negative number when suffix_length > content_length. The buffer access calculation operates on this out-of-range value, classified under [CWE-805] Buffer Access with Incorrect Length Value.

Attack Vector

An unauthenticated remote attacker sends repeated HTTP requests containing a Range header with a suffix length larger than the served resource. Each request produces a malformed 206 response and one or more error log entries. Sustained requests cause log flooding, disk consumption, and response anomalies that may break downstream proxies or clients. No verified exploit code is publicly available at this time.

See the Red Hat CVE-2026-12549 Advisory and GNOME Work Item #516 for technical details on the regression.

Detection Methods for CVE-2026-12549

Indicators of Compromise

Repeated HTTP requests containing Range: bytes=-N headers where N exceeds the resource size
High volume of malformed HTTP 206 Partial Content responses originating from libsoup-based services
Rapid growth of application or system logs containing libsoup Range parsing errors

Detection Strategies

Inspect web server and reverse proxy logs for unusual frequencies of Range headers with negative or oversized suffix values
Correlate spikes in HTTP 206 response rates with single source IPs or small IP ranges
Monitor libsoup version inventories across hosts and flag versions matching the regressed commit range

Monitoring Recommendations

Configure log rotation and disk usage alerts on systems running libsoup-backed services to detect log flooding early
Enable network telemetry capture of HTTP request headers at edge proxies for retrospective hunting
Track requests-per-second and 206 response ratios per client to identify abuse patterns

How to Mitigate CVE-2026-12549

Immediate Actions Required

Inventory all systems and container images that include libsoup and identify versions containing the regressed Range handling code
Apply vendor-supplied libsoup updates as soon as patches become available from Red Hat and the GNOME project
Restart any services linking libsoup after patching to ensure the updated library is loaded

Patch Information

Refer to the Red Hat CVE-2026-12549 Advisory, the related Red Hat CVE-2026-0716 Advisory, and Red Hat Bug Report #2489999 for distribution-specific patched package versions. Track upstream fixes through GNOME Work Item #516.

Workarounds

Deploy a reverse proxy or web application firewall rule that rejects Range headers with suffix lengths exceeding configured thresholds
Restrict or strip Range headers from untrusted clients for resources where partial content delivery is not required
Apply rate limiting on requests producing HTTP 206 responses to mitigate log flooding until patches are deployed

bash

# Example NGINX rule to strip oversized suffix Range headers before reaching a libsoup backend
location / {
    if ($http_range ~* "bytes=-([0-9]{10,})") {
        set $http_range "";
    }
    proxy_pass http://libsoup_backend;
}