CVE catalog

CVE-2026-2369

A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This can allow an attacker to potentially acce

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.43% · Oct 25, 2026

A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This can allow an attacker to potentially access sensitive information or cause an application level denial of service.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibsoup3sid3.8.0-3fixed
Debianlibsoup3forky3.8.0-3fixed
Debianlibsoup3trixie3.6.5-3vulnerable
Debianlibsoup3bookworm3.2.3-0+deb12u2vulnerable
Debianlibsoup2.4trixie2.74.3-10.1vulnerable
Debianlibsoup2.4bookworm2.74.3-1+deb12u1vulnerable
Cpelibsoup2.4Not reportedNot reportedvulnerable
Cpelibsoup3Not reportedNot reportedvulnerable
Cpelibsoup2.4Not reported2.74.3-6ubuntu1.7fixed
Cpegir1.2-soup-2.4Not reported2.74.3-6ubuntu1.7fixed
Cpelibsoup-2.4-1Not reported2.74.3-6ubuntu1.7fixed
Cpelibsoup-gnome-2.4-1Not reported2.74.3-6ubuntu1.7fixed
Cpelibsoup-gnome2.4-devNot reported2.74.3-6ubuntu1.7fixed
Cpelibsoup2.4-commonNot reported2.74.3-6ubuntu1.7fixed
Cpelibsoup2.4-devNot reported2.74.3-6ubuntu1.7fixed
Cpelibsoup2.4-docNot reported2.74.3-6ubuntu1.7fixed
Cpelibsoup2.4-testsNot reported2.74.3-6ubuntu1.7fixed
Ubuntulibsoup2.4pro2.74.3-10.1ubuntu4vulnerable
Ubuntulibsoup2.4pro2.74.3-10.1ubuntu5vulnerable
Ubuntulibsoup2.4pro2.74.3-10.1ubuntu5+esm1fixed
Ubuntulibsoup2.422.042.72.0-3ubuntu3vulnerable
Ubuntulibsoup2.422.042.74.1-1vulnerable
Ubuntulibsoup2.422.042.74.2-2vulnerable
Ubuntulibsoup2.422.042.74.2-3vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.1vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.2vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.3vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.4vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.5vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.6vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.7fixed
Ubuntulibsoup2.424.042.74.3-1vulnerable
Ubuntulibsoup2.424.042.74.3-2vulnerable
Ubuntulibsoup2.424.042.74.3-3vulnerable
Ubuntulibsoup2.424.042.74.3-6vulnerable
Ubuntulibsoup2.424.042.74.3-6build1vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.1vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.2vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.3vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.4vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.5vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.6vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.7fixed
Ubuntulibsoup2.425.102.74.3-10vulnerable
Ubuntulibsoup2.425.102.74.3-10.1vulnerable
Ubuntulibsoup2.425.102.74.3-10.1ubuntu1vulnerable
Ubuntulibsoup2.425.102.74.3-10.1ubuntu2vulnerable
Ubuntulibsoup2.425.102.74.3-10.1ubuntu3vulnerable
Ubuntulibsoup2.425.102.74.3-10.1ubuntu4vulnerable
Ubuntulibsoup2.425.102.74.3-10.1ubuntu4.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibsoup3sourcesid3.6.6-1not yet assignedNot reported[1127843]
Debianlibsoup3sourceforky3.6.6-1not yet assignedNot reported[1127843]
Debianlibsoup3sourcetrixie(unfixed)not yet assignedNot reported[1127843]
Debianlibsoup3sourcebookworm(unfixed)not yet assignedNot reported[1127843]
Debianlibsoup2.4sourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianlibsoup2.4sourcebookworm(unfixed)not yet assignedNot reportedNot reported
Cpelibsoup2.4cpeNot reported2.74.3-6ubuntu1.7Not reportedNot reportedNot reported
Cpegir1.2-soup-2.4cpeNot reported2.74.3-6ubuntu1.7Not reportedNot reportedNot reported
Cpelibsoup-2.4-1cpeNot reported2.74.3-6ubuntu1.7Not reportedNot reportedNot reported
Cpelibsoup-gnome-2.4-1cpeNot reported2.74.3-6ubuntu1.7Not reportedNot reportedNot reported
Cpelibsoup-gnome2.4-devcpeNot reported2.74.3-6ubuntu1.7Not reportedNot reportedNot reported
Cpelibsoup2.4-commoncpeNot reported2.74.3-6ubuntu1.7Not reportedNot reportedNot reported
Cpelibsoup2.4-devcpeNot reported2.74.3-6ubuntu1.7Not reportedNot reportedNot reported
Cpelibsoup2.4-doccpeNot reported2.74.3-6ubuntu1.7Not reportedNot reportedNot reported
Cpelibsoup2.4-testscpeNot reported2.74.3-6ubuntu1.7Not reportedNot reportedNot reported
Ubuntulibsoup2.4debpro2.74.3-10.1ubuntu5+esm1Not reportedUSN-8523-1Not reported
Ubuntulibsoup2.4deb22.042.74.2-3ubuntu0.7Not reportedUSN-8523-1Not reported
Ubuntulibsoup2.4deb24.042.74.3-6ubuntu1.7Not reportedUSN-8523-1Not reported
Ubuntulibsoup2.4deb25.102.74.3-10.1ubuntu4.1Not reportedUSN-8523-1Not reported

[Debian bug #1127843]

Notes

[trixie] libsoup3: Minor issue [bookworm] libsoup3: Minor issue [trixie] libsoup2.4: Minor issue [bookworm] libsoup2.4: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [gir1.2-soup-2.4]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • [gir1.2-soup-3.0]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [libsoup2.4-1]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • [libsoup2.4-common]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · all · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · all · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • [libsoup2.4-dev]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • [libsoup2.4-doc]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · all · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · all · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • [libsoup2.4-tests]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • [libsoup-3.0-0]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [libsoup-3.0-common]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [libsoup-3.0-dev]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [libsoup-3.0-doc]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [libsoup-3.0-tests]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [libsoup-gnome2.4-1]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • [libsoup-gnome2.4-dev]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

[Debian 13 (Trixie)]

  • [gir1.2-soup-2.4]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-10.1 · amd64 · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · arm64 · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

  • [gir1.2-soup-3.0]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.6.5-3 · amd64 · trixie

      Affected

      nvd · libsoup3 · debian · 13

    • 3.6.5-3 · arm64 · trixie

      Affected

      nvd · libsoup3 · debian · 13

  • [libsoup-2.4-1]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-10.1 · amd64 · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · arm64 · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

  • [libsoup2.4-common]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-10.1 · all · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · all · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

  • [libsoup2.4-dev]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-10.1 · amd64 · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · arm64 · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

  • [libsoup2.4-doc]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-10.1 · all · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · all · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

Next results

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]