CVE-2026-66337: libsoup DOS Vulnerability

CVE-2026-66337 Overview

A flaw exists in libsoup, the HTTP client/server library used by GNOME and other Linux applications. An unsigned integer underflow in the soup_filter_input_stream_read_until() function triggers a heap buffer over-read while parsing multipart HTTP responses. A malicious HTTP server can send a crafted multipart response to exploit the condition. Successful exploitation can crash the client application or disclose sensitive heap memory. The issue is tracked under [CWE-125] (Out-of-Bounds Read) and requires no authentication or user interaction.

Critical Impact
A remote, unauthenticated attacker controlling an HTTP server can cause client crashes and leak heap memory from applications linked against libsoup.

Affected Products

libsoup (upstream GNOME HTTP library)
Red Hat products bundling libsoup (see Red Hat advisory)
Applications and desktop environments consuming libsoup for HTTP client functionality

Discovery Timeline

2026-07-24 - CVE-2026-66337 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-66337

Vulnerability Analysis

The flaw resides in soup_filter_input_stream_read_until(), a helper used when libsoup parses multipart HTTP response bodies. The function performs arithmetic on an unsigned integer that can underflow when the parser encounters a specially shaped multipart payload. When the underflow occurs, subsequent read operations treat the wrapped value as a very large size, driving a read past the allocated heap buffer.

The consequence is an out-of-bounds read from adjacent heap memory. Depending on the memory layout of the client process, the leaked bytes may include response fragments, credentials, tokens, or other sensitive material previously stored on the heap. The same over-read can also trigger a segmentation fault, terminating the client.

Root Cause

The root cause is missing validation of the computed length used to advance the read cursor inside soup_filter_input_stream_read_until(). Because the arithmetic operates on an unsigned integer without bounds checks, a boundary marker positioned to make the subtraction go negative wraps the value to near SIZE_MAX.

Attack Vector

An attacker hosts or takes control of an HTTP server that a libsoup-based client contacts. The server returns a multipart HTTP response with a crafted boundary sequence that induces the underflow during parsing. No credentials or user interaction beyond a client-initiated request are required. Any workflow that fetches remote HTTP resources through libsoup, including background sync, feed readers, and package or metadata clients, is a viable trigger path.

No public proof-of-concept is currently referenced in the advisory. Refer to the Red Hat CVE-2026-66337 Advisory and the Red Hat Bug Tracker Entry for maintainer analysis and patch tracking.

Detection Methods for CVE-2026-66337

Indicators of Compromise

Unexpected crashes or segmentation faults in processes linked against libsoup shortly after outbound HTTP traffic.
HTTP responses with malformed or unusually long multipart boundary strings observed in proxy or network telemetry.
Core dumps referencing soup_filter_input_stream_read_until in the crashing stack frame.

Detection Strategies

Inspect HTTP response bodies at egress proxies for multipart payloads with malformed Content-Type: multipart/* boundary declarations.
Correlate application crash telemetry with recent outbound connections to untrusted or newly observed domains.
Enable AddressSanitizer or equivalent heap instrumentation in test environments to surface out-of-bounds reads during fuzzing of multipart responses.

Monitoring Recommendations

Track installed libsoup package versions across the fleet and flag hosts running unpatched builds.
Alert on libsoup-linked processes exhibiting repeated abnormal termination after HTTP activity.
Log outbound HTTP connections from desktop and server workloads to enable retrospective hunting once server indicators are known.

How to Mitigate CVE-2026-66337

Immediate Actions Required

Apply the libsoup update from your distribution as soon as it becomes available; monitor the Red Hat advisory for fixed package versions.
Restart any long-running services or desktop sessions that link libsoup after patching to ensure the new library is loaded.
Restrict outbound HTTP access from sensitive hosts to trusted destinations while patches are being rolled out.

Patch Information

Patched libsoup builds are being distributed through vendor channels. Consult the Red Hat CVE-2026-66337 Advisory for the affected Red Hat components and fixed versions, and the Red Hat Bug Tracker Entry for upstream patch references. Downstream distributions should be checked for their own updated packages.

Workarounds

Route libsoup-based clients through a filtering proxy that rejects malformed multipart responses.
Limit which applications are permitted to make outbound HTTP requests to untrusted servers until patches are deployed.
Where feasible, disable or avoid features that fetch multipart HTTP content from external sources.

bash

# Example: verify installed libsoup version on a Red Hat-based host
rpm -q libsoup libsoup3
# After patching, confirm the updated version matches the vendor advisory
dnf updateinfo info --cve CVE-2026-66337