CVE-2026-12549Medium· 4.8▾ SunlitThe fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resul…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 26.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding.
libsoup3 (all versions)libsouplibsouplibsoup (all versions)libsoup (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
To mitigate this issue, applications utilizing libsoup's WebSocket support should ensure that the max_incoming_payload_size is explicitly set to a non-zero value. This prevents the library from processing WebSocket frames with an unset or zero maximum payload size, which can lead to out-of-bounds reads. Consult application-specific documentation for configuring libsoup parameters.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-0716Medium· 4.8A flaw was found in libsoup’s WebSocket frame processing when handling incoming messages
CVE-2026-77680Medium· 5.3Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix
CVE-2026-77014Medium· 5.3Libsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responses
CVE-2026-6695Medium· 5.5Gimp: gimp: remote code execution via crafted paa file
CVE-2026-66337Medium· 6.5Libsoup: libsoup: heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()
CVE-2026-66339Medium· 6.5Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels