CVE-2026-15714: libsoup Multipart DoS Vulnerability

CVE-2026-15714 Overview

CVE-2026-15714 is an out-of-bounds read vulnerability in the libsoup HTTP client/server library used across GNOME and many Linux distributions. The flaw resides in the soup_multipart_input_stream_read_headers() function within soup-multipart-input-stream.c. The function does not adequately validate the size of incoming multipart boundary strings. When libsoup parses a crafted HTTP response containing a malformed or oversized boundary parameter, the internal stream reader accesses memory beyond the allocated buffer. A remote, unauthenticated attacker can trigger the condition to cause a denial-of-service (DoS) or disclose adjacent memory contents. The weakness is classified under [CWE-125: Out-of-bounds Read].

Critical Impact
A remote attacker can crash any application using libsoup to consume attacker-controlled multipart HTTP responses, and may read fragments of process memory adjacent to the multipart buffer.

Affected Products

GNOME libsoup (multipart input stream component)
Red Hat Enterprise Linux distributions packaging affected libsoup versions
Downstream applications consuming multipart HTTP responses through libsoup

Discovery Timeline

2026-07-14 - CVE-2026-15714 published to the National Vulnerability Database
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15714

Vulnerability Analysis

The defect resides in libsoup's multipart parsing path. When libsoup receives an HTTP response with a Content-Type: multipart/* header, it extracts the boundary parameter and hands processing to soup_multipart_input_stream_read_headers() in soup-multipart-input-stream.c. The function reads incoming bytes into an internal buffer and compares them against the boundary marker. It fails to bound-check the boundary length against the buffer size before performing the comparison. A crafted response with an oversized or malformed boundary causes the reader to advance past the end of the allocated region.

The consequence is a linear out-of-bounds read [CWE-125]. Depending on process layout, the read may touch unmapped pages and trigger a SIGSEGV, terminating the client process. If the adjacent memory is mapped, the parser may incorporate its contents into subsequent comparisons or error paths, permitting limited disclosure of heap metadata to a remote observer.

Root Cause

The root cause is missing input validation on the length of the multipart boundary string prior to buffer indexing. The stream reader trusts the boundary value derived from the response headers and does not enforce an upper bound aligned with the internal read buffer. This is a classic boundary-condition error in a network-facing parser.

Attack Vector

Exploitation requires that a libsoup-based application issue an HTTP(S) request to an attacker-controlled or attacker-influenced endpoint that returns a malicious multipart response. No authentication or user interaction beyond initiating the request is required. Attack scenarios include malicious web servers targeting GNOME applications, HTTP proxies injecting crafted responses, and man-in-the-middle positions on cleartext links. The vulnerability manifests in the boundary parsing routine described above. See the Red Hat CVE-2026-15714 Advisory and the GNOME Work Item #542 for technical details.

Detection Methods for CVE-2026-15714

Indicators of Compromise

Repeated crashes or SIGSEGV terminations of processes linking libsoup (for example, evolution, gnome-online-accounts, geary, or custom libsoup clients).
HTTP responses containing Content-Type: multipart/* headers with unusually long or non-printable boundary parameters.
Core dumps referencing soup_multipart_input_stream_read_headers in the crashing stack frame.

Detection Strategies

Inspect HTTP response traffic at proxies or IDS sensors for Content-Type headers with boundary values exceeding several hundred bytes or containing unexpected control characters.
Correlate application crash telemetry with recent outbound HTTP sessions to identify servers returning malformed multipart responses.
Query package inventories for the installed libsoup version and compare against vendor-published fixed versions.

Monitoring Recommendations

Enable core-dump collection and stack-trace forwarding for desktop and server workloads that depend on libsoup.
Log outbound HTTP destinations from libsoup-based services to build a baseline of expected multipart-serving endpoints.
Track advisories from Red Hat and the upstream GNOME libsoup project for patch releases.

How to Mitigate CVE-2026-15714

Immediate Actions Required

Apply distribution-supplied libsoup updates as soon as they are published by your vendor.
Restart all long-running processes that link libsoup after the package update so the patched library is loaded.
Restrict outbound HTTP traffic from sensitive libsoup-based services to trusted endpoints where feasible.

Patch Information

At time of publication, tracking is available through the Red Hat CVE-2026-15714 Advisory, the Red Hat Bug Report #2499942, and the upstream GNOME Work Item #542. Consult these references for the fixed libsoup version applicable to your distribution and rebuild any statically linked consumers accordingly.

Workarounds

Route libsoup client traffic through an HTTP-inspecting proxy that strips or normalizes malformed Content-Type: multipart/* boundary parameters.
Disable or avoid application features that fetch multipart HTTP responses from untrusted origins until the patch is applied.
Where the application permits, configure it to reject responses whose boundary length exceeds a conservative threshold.

bash

# Configuration example: verify installed libsoup version and refresh dependent services
rpm -q libsoup libsoup3
sudo dnf update libsoup libsoup3
sudo systemctl restart <service-using-libsoup>