CVE catalog
CVE-2026-0719
libsoup3 affected and fixed versions
A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication. When processing extremely long passwords, an internal size calculation can overflow due to improper use of signed integers. This results in incorrect memory allocation on the stack, followed by unsafe memory copying. As a result, applications using libsoup may crash unexpectedly, creating a denial-of-service risk.
- Severity
- High · CVSS 8.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.61% · Oct 27, 2026
Projects and upstream resources
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
Version impact has not been established. The original provider fields are retained below.
Provider details and historical evidence
Original provider fields
{
"package_releases": [
{
"name": "libsoup3",
"status": "fixed",
"release": "sid",
"version": "3.8.0-3"
},
{
"name": "libsoup3",
"status": "fixed",
"release": "forky",
"version": "3.8.0-3"
},
{
"name": "libsoup3",
"status": "vulnerable",
"release": "trixie",
"version": "3.6.5-3"
},
{
"name": "libsoup3",
"status": "vulnerable",
"release": "bookworm",
"version": "3.2.3-0+deb12u2"
},
{
"name": "libsoup2.4",
"status": "vulnerable",
"release": "trixie",
"version": "2.74.3-10.1"
},
{
"name": "libsoup2.4",
"status": "vulnerable",
"release": "bookworm",
"version": "2.74.3-1+deb12u1"
}
],
"fixed_versions": [
{
"bug": 1125083,
"name": "libsoup3",
"type": "source",
"origin": null,
"release": "sid",
"urgency": "not yet assigned",
"fixed_version": "3.8.0-1"
},
{
"bug": 1125083,
"name": "libsoup3",
"type": "source",
"origin": null,
"release": "forky",
"urgency": "not yet assigned",
"fixed_version": "3.8.0-1"
},
{
"bug": 1125083,
"name": "libsoup3",
"type": "source",
"origin": null,
"release": "trixie",
"urgency": "not yet assigned",
"fixed_version": ""
},
{
"bug": 1125083,
"name": "libsoup3",
"type": "source",
"origin": null,
"release": "bookworm",
"urgency": "not yet assigned",
"fixed_version": ""
},
{
"bug": null,
"name": "libsoup2.4",
"type": "source",
"origin": null,
"release": "trixie",
"urgency": "not yet assigned",
"fixed_version": ""
},
{
"bug": null,
"name": "libsoup2.4",
"type": "source",
"origin": null,
"release": "bookworm",
"urgency": "not yet assigned",
"fixed_version": ""
}
],
"distribution_packages": [
{
"name": "libsoup2",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.74.3-14.1"
}
]
}
],
"release": "tumbleweed",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "2.74.3-14.1",
"provider_record_id": "OPENSUSE-SU-2026:10041-1"
},
{
"name": "libsoup",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.62.2-5.26.1"
}
]
}
],
"release": "linux enterprise server 12 sp5-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "2.62.2-5.26.1",
"provider_record_id": "SUSE-SU-2026:0265-1"
},
{
"name": "libsoup",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.62.2-5.26.1"
}
]
}
],
"release": "linux enterprise server ltss extended security 12 sp5",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "2.62.2-5.26.1",
"provider_record_id": "SUSE-SU-2026:0265-1"
},
{
"name": "libsoup2.4",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "pro",
"versions": [
"2.74.3-10.1ubuntu4",
"2.74.3-10.1ubuntu5",
"2.74.3-10.1ubuntu5+esm1",
"2.74.3-10.1ubuntu5+esm2",
"2.74.3-10.1ubuntu5+esm3"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-0719"
},
{
"name": "libsoup2.4",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "22.04",
"versions": [
"2.72.0-3ubuntu3",
"2.74.1-1",
"2.74.2-2",
"2.74.2-3",
"2.74.2-3ubuntu0.1",
"2.74.2-3ubuntu0.2",
"2.74.2-3ubuntu0.3",
"2.74.2-3ubuntu0.4",
"2.74.2-3ubuntu0.5",
"2.74.2-3ubuntu0.6",
"2.74.2-3ubuntu0.7",
"2.74.2-3ubuntu0.8",
"2.74.2-3ubuntu0.9"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-0719"
},
{
"name": "libsoup3",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "pro",
"versions": [
"3.0.4-2",
"3.0.4-3",
"3.0.5-1",
"3.0.7-0ubuntu1",
"3.0.7-0ubuntu1+esm1",
"3.0.7-0ubuntu1+esm2",
"3.0.7-0ubuntu1+esm3",
"3.0.7-0ubuntu1+esm4",
"3.0.7-0ubuntu1+esm5",
"3.0.7-0ubuntu1+esm6",
"3.0.7-0ubuntu1+esm7",
"3.0.7-0ubuntu1+esm8",
"3.0.7-0ubuntu1+esm9"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-0719"
},
{
"name": "libsoup2.4",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "24.04",
"versions": [
"2.74.3-1",
"2.74.3-2",
"2.74.3-3",
"2.74.3-6",
"2.74.3-6build1",
"2.74.3-6ubuntu1",
"2.74.3-6ubuntu1.1",
"2.74.3-6ubuntu1.2",
"2.74.3-6ubuntu1.3",
"2.74.3-6ubuntu1.4",
"2.74.3-6ubuntu1.5",
"2.74.3-6ubuntu1.6",
"2.74.3-6ubuntu1.7",
"2.74.3-6ubuntu1.8",
"2.74.3-6ubuntu1.9"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-0719"
},
{
"name": "libsoup3",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "24.04",
"versions": [
"3.4.2-4",
"3.4.4-1",
"3.4.4-2",
"3.4.4-4",
"3.4.4-5",
"3.4.4-5build1",
"3.4.4-5build2",
"3.4.4-5ubuntu0.1",
"3.4.4-5ubuntu0.2",
"3.4.4-5ubuntu0.3",
"3.4.4-5ubuntu0.4",
"3.4.4-5ubuntu0.5",
"3.4.4-5ubuntu0.6",
"3.4.4-5ubuntu0.7",
"3.4.4-5ubuntu0.8",
"3.4.4-5ubuntu0.9"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-0719"
},
{
"name": "libsoup2.4",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "25.10",
"versions": [
"2.74.3-10",
"2.74.3-10.1",
"2.74.3-10.1ubuntu1",
"2.74.3-10.1ubuntu2",
"2.74.3-10.1ubuntu3",
"2.74.3-10.1ubuntu4",
"2.74.3-10.1ubuntu4.1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-0719"
},
{
"name": "libsoup3",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "25.10",
"versions": [
"3.6.5-1",
"3.6.5-1ubuntu1",
"3.6.5-3",
"3.6.5-4",
"3.6.5-4ubuntu0.1",
"3.6.5-4ubuntu0.2"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-0719"
},
{
"name": "libsoup2.4",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "26.10",
"versions": [
"2.74.3-10.1ubuntu5"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-0719"
},
{
"name": "libsoup3",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "26.10",
"versions": [
"3.6.6-1",
"3.6.6-1ubuntu3"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-0719"
},
{
"name": "libsoup3",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "26.04",
"versions": [
"3.6.5-4",
"3.6.5-5",
"3.6.5-6",
"3.6.5-7",
"3.6.5-9",
"3.6.6-1",
"3.6.6-1ubuntu0.1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-0719"
}
]
}Publisher notes
[trixie] libsoup3: Minor issue [bookworm] libsoup3: Minor issue [trixie] libsoup2.4: Minor issue [bookworm] libsoup2.4: Minor issue
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [gir1.2-soup-2.4]Unknown
Source package: [libsoup2.4]
Details (2)
2.74.3-1+deb12u1· amd64 · bookwormAffected
dsa · libsoup2.4 · debian · bookworm; dsa · libsoup2.4 · debian · 12
2.74.3-1+deb12u1· arm64 · bookwormAffected
dsa · libsoup2.4 · debian · bookworm; dsa · libsoup2.4 · debian · 12
- [gir1.2-soup-3.0]Unknown
Source package: [libsoup3]
Details (2)
3.2.3-0+deb12u2· amd64 · bookwormAffected
dsa · libsoup3 · debian · bookworm; dsa · libsoup3 · debian · 12
3.2.3-0+deb12u2· arm64 · bookwormAffected
dsa · libsoup3 · debian · bookworm; dsa · libsoup3 · debian · 12
- [libsoup2.4-1]Unknown
Source package: [libsoup2.4]
Details (2)
2.74.3-1+deb12u1· amd64 · bookwormAffected
dsa · libsoup2.4 · debian · bookworm; dsa · libsoup2.4 · debian · 12
2.74.3-1+deb12u1· arm64 · bookwormAffected
dsa · libsoup2.4 · debian · bookworm; dsa · libsoup2.4 · debian · 12
- [libsoup2.4-common]Unknown
Source package: [libsoup2.4]
Details (2)
2.74.3-1+deb12u1· all · bookwormAffected
dsa · libsoup2.4 · debian · bookworm; dsa · libsoup2.4 · debian · 12
2.74.3-1+deb12u1· all · bookwormAffected
dsa · libsoup2.4 · debian · bookworm; dsa · libsoup2.4 · debian · 12
- [libsoup2.4-dev]Unknown
Source package: [libsoup2.4]
Details (2)
2.74.3-1+deb12u1· amd64 · bookwormAffected
dsa · libsoup2.4 · debian · bookworm; dsa · libsoup2.4 · debian · 12
2.74.3-1+deb12u1· arm64 · bookwormAffected
dsa · libsoup2.4 · debian · bookworm; dsa · libsoup2.4 · debian · 12
- [libsoup2.4-doc]Unknown
Source package: [libsoup2.4]
Details (2)
2.74.3-1+deb12u1· all · bookwormAffected
dsa · libsoup2.4 · debian · bookworm; dsa · libsoup2.4 · debian · 12
2.74.3-1+deb12u1· all · bookwormAffected
dsa · libsoup2.4 · debian · bookworm; dsa · libsoup2.4 · debian · 12
- [libsoup2.4-tests]Unknown
Source package: [libsoup2.4]
Details (2)
2.74.3-1+deb12u1· amd64 · bookwormAffected
dsa · libsoup2.4 · debian · bookworm; dsa · libsoup2.4 · debian · 12
2.74.3-1+deb12u1· arm64 · bookwormAffected
dsa · libsoup2.4 · debian · bookworm; dsa · libsoup2.4 · debian · 12
- [libsoup-3.0-0]Unknown
Source package: [libsoup3]
Details (2)
3.2.3-0+deb12u2· amd64 · bookwormAffected
dsa · libsoup3 · debian · bookworm; dsa · libsoup3 · debian · 12
3.2.3-0+deb12u2· arm64 · bookwormAffected
dsa · libsoup3 · debian · bookworm; dsa · libsoup3 · debian · 12
- [libsoup-3.0-common]Unknown
Source package: [libsoup3]
Details (2)
3.2.3-0+deb12u2· all · bookwormAffected
dsa · libsoup3 · debian · bookworm; dsa · libsoup3 · debian · 12
3.2.3-0+deb12u2· all · bookwormAffected
dsa · libsoup3 · debian · bookworm; dsa · libsoup3 · debian · 12
- [libsoup-3.0-dev]Unknown
Source package: [libsoup3]
Details (2)
3.2.3-0+deb12u2· amd64 · bookwormAffected
dsa · libsoup3 · debian · bookworm; dsa · libsoup3 · debian · 12
3.2.3-0+deb12u2· arm64 · bookwormAffected
dsa · libsoup3 · debian · bookworm; dsa · libsoup3 · debian · 12
- [libsoup-3.0-doc]Unknown
Source package: [libsoup3]
Details (2)
3.2.3-0+deb12u2· all · bookwormAffected
dsa · libsoup3 · debian · bookworm; dsa · libsoup3 · debian · 12
3.2.3-0+deb12u2· all · bookwormAffected
dsa · libsoup3 · debian · bookworm; dsa · libsoup3 · debian · 12
- [libsoup-3.0-tests]Unknown
Source package: [libsoup3]
Details (2)
3.2.3-0+deb12u2· amd64 · bookwormAffected
dsa · libsoup3 · debian · bookworm; dsa · libsoup3 · debian · 12
3.2.3-0+deb12u2· arm64 · bookwormAffected
dsa · libsoup3 · debian · bookworm; dsa · libsoup3 · debian · 12
- [libsoup-gnome2.4-1]Unknown
Source package: [libsoup2.4]
Details (2)
2.74.3-1+deb12u1· amd64 · bookwormAffected
dsa · libsoup2.4 · debian · bookworm; dsa · libsoup2.4 · debian · 12
2.74.3-1+deb12u1· arm64 · bookwormAffected
dsa · libsoup2.4 · debian · bookworm; dsa · libsoup2.4 · debian · 12
- [libsoup-gnome2.4-dev]Unknown
Source package: [libsoup2.4]
Details (2)
2.74.3-1+deb12u1· amd64 · bookwormAffected
dsa · libsoup2.4 · debian · bookworm; dsa · libsoup2.4 · debian · 12
2.74.3-1+deb12u1· arm64 · bookwormAffected
dsa · libsoup2.4 · debian · bookworm; dsa · libsoup2.4 · debian · 12
[Debian 13 (Trixie)]
- [gir1.2-soup-2.4]Unknown
Source package: [libsoup2.4]
Details (2)
2.74.3-10.1· amd64 · trixieAffected
dsa · libsoup2.4 · debian · 13
2.74.3-10.1· arm64 · trixieAffected
dsa · libsoup2.4 · debian · 13
- [gir1.2-soup-3.0]Unknown
Source package: [libsoup3]
Details (2)
3.6.5-3· amd64 · trixieAffected
dsa · libsoup3 · debian · 13
3.6.5-3· arm64 · trixieAffected
dsa · libsoup3 · debian · 13
- [libsoup-2.4-1]Unknown
Source package: [libsoup2.4]
Details (2)
2.74.3-10.1· amd64 · trixieAffected
dsa · libsoup2.4 · debian · 13
2.74.3-10.1· arm64 · trixieAffected
dsa · libsoup2.4 · debian · 13
- [libsoup2.4-common]Unknown
Source package: [libsoup2.4]
Details (2)
2.74.3-10.1· all · trixieAffected
dsa · libsoup2.4 · debian · 13
2.74.3-10.1· all · trixieAffected
dsa · libsoup2.4 · debian · 13
- [libsoup2.4-dev]Unknown
Source package: [libsoup2.4]
Details (2)
2.74.3-10.1· amd64 · trixieAffected
dsa · libsoup2.4 · debian · 13
2.74.3-10.1· arm64 · trixieAffected
dsa · libsoup2.4 · debian · 13
- [libsoup2.4-doc]Unknown
Source package: [libsoup2.4]
Details (2)
2.74.3-10.1· all · trixieAffected
dsa · libsoup2.4 · debian · 13
2.74.3-10.1· all · trixieAffected
dsa · libsoup2.4 · debian · 13
Observed:
References
- [https://access.redhat.com/errata/RHSA-2026:1948]
- [https://access.redhat.com/errata/RHSA-2026:2005]
- [https://access.redhat.com/errata/RHSA-2026:2006]
- [https://access.redhat.com/errata/RHSA-2026:2007]
- [https://access.redhat.com/errata/RHSA-2026:2008]
- [https://access.redhat.com/errata/RHSA-2026:2049]
- [https://access.redhat.com/errata/RHSA-2026:2182]
- [https://access.redhat.com/errata/RHSA-2026:2214]
- [https://access.redhat.com/errata/RHSA-2026:2215]
- [https://access.redhat.com/errata/RHSA-2026:2216]
- [https://access.redhat.com/errata/RHSA-2026:2396]
- [https://access.redhat.com/errata/RHSA-2026:2402]
- [https://access.redhat.com/errata/RHSA-2026:2512]
- [https://access.redhat.com/errata/RHSA-2026:2513]
- [https://access.redhat.com/errata/RHSA-2026:2514]
- [https://access.redhat.com/errata/RHSA-2026:2528]
- [https://access.redhat.com/errata/RHSA-2026:2529]
- [https://access.redhat.com/errata/RHSA-2026:2628]
- [https://access.redhat.com/errata/RHSA-2026:2844]
- [https://access.redhat.com/security/cve/CVE-2026-0719]
- [https://bugzilla.redhat.com/show_bug.cgi?id=2427906]
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10040-1.json]
- [https://gitlab.gnome.org/GNOME/libsoup/-/issues/477]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-0719]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-0719]
- [https://osv.dev/vulnerability/SUSE-SU-2026:0265-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-0719]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10041-1]
- [https://security-tracker.debian.org/tracker/CVE-2026-0719]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0719.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1730.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]