CVE-2026-77014: libsoup SoupServer DOS Vulnerability

CVE-2026-77014 Overview

CVE-2026-77014 is a numeric truncation flaw in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to a 32-bit int. When two range offsets differ by more than INT_MAX, the sign of the comparator return value flips. This produces an incorrect sort order for requested byte ranges. Servers built on libsoup then silently omit ranges from HTTP 206 Partial Content responses when clients request resources larger than approximately 2 GB. The defect is tracked under [CWE-197] Numeric Truncation Error.

Critical Impact
Remote clients can trigger silent omission of requested byte ranges in HTTP 206 Partial Content responses served from resources larger than 2 GB, breaking data integrity for range-based downloads.

Affected Products

libsoup (GNOME HTTP client/server library) — SoupServer component
Applications and services embedding libsoup for HTTP serving
Linux distributions shipping vulnerable libsoup builds (see Red Hat advisory)

Discovery Timeline

2026-08-20 - CVE-2026-77014 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-77014

Vulnerability Analysis

The defect lives in the range-sorting logic used when libsoup processes an HTTP Range request header. The comparator function sort_ranges() computes the difference between two range offsets and returns the result as an int. Offsets are 64-bit values, but the subtraction is narrowed on return. When the true difference exceeds INT_MAX (roughly 2,147,483,647), the narrowed value wraps and its sign inverts.

An inverted comparator return breaks the ordering contract expected by the sort routine. The resulting range array is not correctly ordered, and downstream logic that merges or emits ranges skips entries. Clients receive an HTTP 206 Partial Content response that omits requested byte ranges without any error signal.

The impact is scoped to data integrity of range responses. There is no memory corruption, no code execution, and no confidentiality loss. However, applications that rely on Range requests for large media, backups, or software updates can receive incomplete data.

Root Cause

The root cause is an unsafe narrowing conversion from a 64-bit signed difference to a 32-bit signed int inside the sort comparator. C comparator functions must return only the sign of the comparison, not the raw difference. Returning a truncated subtraction is unsafe whenever operands can differ by more than INT_MAX.

Attack Vector

The vulnerability is reachable over the network without authentication or user interaction. A remote client sends a crafted Range header with multiple ranges whose offsets span more than 2 GB against a resource larger than 2 GB served by a libsoup-based server. The server responds with a 206 Partial Content payload that silently omits ranges. See the GNOME libsoup Merge Request for the corrected comparator implementation.

No verified public exploit code is available. The vulnerability mechanism is described in prose per the Red Hat CVE-2026-77014 Advisory and Red Hat Bugzilla Report #2520143.

Detection Methods for CVE-2026-77014

Indicators of Compromise

HTTP 206 Partial Content responses served from libsoup where the response body length is smaller than the sum of requested range lengths in the client's Range header.
Client-side integrity failures (hash mismatches, truncated files) after multi-range downloads of resources larger than 2 GB from libsoup-backed services.
Server access logs showing Range request headers containing multiple byte ranges with offset gaps exceeding INT_MAX.

Detection Strategies

Inventory hosts running libsoup and identify services that expose SoupServer endpoints capable of serving files above 2 GB.
Compare installed libsoup package versions against the fixed versions listed in the Red Hat CVE-2026-77014 Advisory.
Add integration tests that request multi-range payloads spanning large offsets and validate response completeness against the requested ranges.

Monitoring Recommendations

Log and alert on multi-range HTTP requests whose delivered response size does not match the requested range totals.
Track HTTP 206 response volume and payload sizes for services fronted by libsoup and investigate anomalies in short byte-range responses.
Correlate client-reported download integrity failures with server versions to surface vulnerable libsoup deployments.

How to Mitigate CVE-2026-77014

Immediate Actions Required

Apply the libsoup security update from your Linux distribution as soon as vendor packages are available.
Identify all applications that link libsoup and serve HTTP content, and restart them after patching to reload the fixed library.
Validate that large-file range downloads from libsoup-backed services succeed with correct byte counts after the update.

Patch Information

The upstream fix is available in the GNOME libsoup Merge Request, which corrects sort_ranges() in soup-message-headers.c to return only the sign of the 64-bit comparison rather than a truncated difference. Track distribution-specific package availability through the Red Hat CVE-2026-77014 Advisory.

Workarounds

Front libsoup-backed services with a reverse proxy (for example, nginx or HAProxy) that handles Range requests directly and forwards only full-object requests upstream.
Reject or normalize multi-range Range request headers at the proxy layer until libsoup is patched.
Restrict libsoup-served resources to under 2 GB where feasible, since the defect only manifests on larger resources.

bash

# Example nginx snippet: strip multi-range requests before proxying to a libsoup backend
location / {
    if ($http_range ~* ",") {
        set $http_range "";
    }
    proxy_set_header Range $http_range;
    proxy_pass http://libsoup_backend;
}