Log in Start free

Vulnerability · Published Aug 20, 2026 · Assigned by redhat

CVE-2026-77014Libsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responses

Medium 5.3

In plain English

A medium-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 85.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libsoup2.4no fix listedDEBIAN-CVE-2026-77014
Debian:13libsoup2.4no fix listedDEBIAN-CVE-2026-77014
Debian:12libsoup3no fix listedDEBIAN-CVE-2026-77014
Debian:13libsoup3no fix listedDEBIAN-CVE-2026-77014
Ubuntu:22.04:LTSlibsoup2.42.74.2-3ubuntu0.9UBUNTU-CVE-2026-77014
Ubuntu:22.04:LTSlibsoup2.42.74.2-3ubuntu0.9USN-8890-1
Ubuntu:24.04:LTSlibsoup2.42.74.3-6ubuntu1.9USN-8890-1
Ubuntu:24.04:LTSlibsoup2.42.74.3-6ubuntu1.9UBUNTU-CVE-2026-77014
Ubuntu:26.10libsoup2.4no fix listedUBUNTU-CVE-2026-77014
Ubuntu:24.04:LTSlibsoup33.4.4-5ubuntu0.9UBUNTU-CVE-2026-77014
Ubuntu:24.04:LTSlibsoup33.4.4-5ubuntu0.9USN-8890-1
Ubuntu:26.04:LTSlibsoup33.6.6-1ubuntu0.1UBUNTU-CVE-2026-77014
Ubuntu:26.04:LTSlibsoup33.6.6-1ubuntu0.1USN-8890-1
Ubuntu:26.10libsoup33.6.6-1ubuntu3UBUNTU-CVE-2026-77014
Ubuntu:26.10libsoup33.6.6-1ubuntu3USN-8890-2

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat OpenShift Container Platform 4 see references

Weakness: CWE-197 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References