CVE catalog

CVE-2026-77680

An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the sa

[CVE catalog]

Severity
High · CVSS 7.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.34% · Oct 25, 2026

An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N²) work coalescing them into a single range. The vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required. The number of ranges is bounded only by the maximum request header size (~100 KiB), allowing roughly 25,000 ranges per request. Reporter measurements on libsoup HEAD containing the CVE-2025-32907 fix show ~90 ms single-core CPU per such request at the wire maximum, blocking the server's event loop for that duration. This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs. Affected: libsoup versions containing the CVE-2025-32907 fix but not merge request !550. Fixed upstream: MR !550 merged 2026-08-20, replacing per-element removal with O(N) in-place compaction and rejecting Range headers requesting more than 200 ranges. Upstream report: https://gitlab.gnome.org/GNOME/libsoup/-/issues/538 Related: CVE-2025-32907

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibsoup3sid3.8.0-3fixed
Debianlibsoup3forky3.8.0-3fixed
Debianlibsoup3trixie3.6.5-3vulnerable
Debianlibsoup3bookworm3.2.3-0+deb12u2vulnerable
Debianlibsoup2.4trixie2.74.3-10.1vulnerable
Debianlibsoup2.4bookworm2.74.3-1+deb12u1vulnerable
Ubuntulibsoup2.4noble2.74.3-6ubuntu1.9fixed
Ubuntulibsoup3noble3.4.4-5ubuntu0.9fixed
Ubuntugir1.2-soup-2.4noble2.74.3-6ubuntu1.9fixed
Ubuntugir1.2-soup-3.0noble3.4.4-5ubuntu0.9fixed
Ubuntulibsoup-2.4-1noble2.74.3-6ubuntu1.9fixed
Ubuntulibsoup-3.0-0noble3.4.4-5ubuntu0.9fixed
Ubuntulibsoup-3.0-commonnoble3.4.4-5ubuntu0.9fixed
Ubuntulibsoup-3.0-devnoble3.4.4-5ubuntu0.9fixed
Ubuntulibsoup-3.0-docnoble3.4.4-5ubuntu0.9fixed
Ubuntulibsoup-3.0-testsnoble3.4.4-5ubuntu0.9fixed
Ubuntulibsoup-gnome-2.4-1noble2.74.3-6ubuntu1.9fixed
Ubuntulibsoup-gnome2.4-devnoble2.74.3-6ubuntu1.9fixed
Ubuntulibsoup2.4-commonnoble2.74.3-6ubuntu1.9fixed
Ubuntulibsoup2.4-devnoble2.74.3-6ubuntu1.9fixed
Ubuntulibsoup2.4-docnoble2.74.3-6ubuntu1.9fixed
Ubuntulibsoup2.4-testsnoble2.74.3-6ubuntu1.9fixed
Ubuntulibsoup2.4pro2.74.3-10.1ubuntu4vulnerable
Ubuntulibsoup2.4pro2.74.3-10.1ubuntu5vulnerable
Ubuntulibsoup2.4pro2.74.3-10.1ubuntu5+esm1vulnerable
Ubuntulibsoup2.4pro2.74.3-10.1ubuntu5+esm2vulnerable
Ubuntulibsoup2.4pro2.74.3-10.1ubuntu5+esm3fixed
Ubuntulibsoup2.422.042.72.0-3ubuntu3vulnerable
Ubuntulibsoup2.422.042.74.1-1vulnerable
Ubuntulibsoup2.422.042.74.2-2vulnerable
Ubuntulibsoup2.422.042.74.2-3vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.1vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.2vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.3vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.4vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.5vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.6vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.7vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.8vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.9fixed
Ubuntulibsoup3pro3.0.4-2vulnerable
Ubuntulibsoup3pro3.0.4-3vulnerable
Ubuntulibsoup3pro3.0.5-1vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm1vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm2vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm3vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm4vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm5vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm6vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm7vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm8vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm9fixed
Ubuntulibsoup2.424.042.74.3-1vulnerable
Ubuntulibsoup2.424.042.74.3-2vulnerable
Ubuntulibsoup2.424.042.74.3-3vulnerable
Ubuntulibsoup2.424.042.74.3-6vulnerable
Ubuntulibsoup2.424.042.74.3-6build1vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.1vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.2vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.3vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.4vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.5vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.6vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.7vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.8vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.9fixed
Ubuntulibsoup324.043.4.2-4vulnerable
Ubuntulibsoup324.043.4.4-1vulnerable
Ubuntulibsoup324.043.4.4-2vulnerable
Ubuntulibsoup324.043.4.4-4vulnerable
Ubuntulibsoup324.043.4.4-5vulnerable
Ubuntulibsoup324.043.4.4-5build1vulnerable
Ubuntulibsoup324.043.4.4-5build2vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.1vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.2vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.3vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.4vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.5vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.6vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.7vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.8vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.9fixed
Ubuntulibsoup2.426.102.74.3-10.1ubuntu5vulnerable
Ubuntulibsoup326.103.6.6-1vulnerable
Ubuntulibsoup326.103.6.6-1ubuntu3fixed
Ubuntulibsoup326.043.6.5-4vulnerable
Ubuntulibsoup326.043.6.5-5vulnerable
Ubuntulibsoup326.043.6.5-6vulnerable
Ubuntulibsoup326.043.6.5-7vulnerable
Ubuntulibsoup326.043.6.5-9vulnerable
Ubuntulibsoup326.043.6.6-1vulnerable
Ubuntulibsoup326.043.6.6-1ubuntu0.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibsoup3sourcesid3.8.0-1not yet assignedNot reported[1145785]
Debianlibsoup3sourceforky3.8.0-1not yet assignedNot reported[1145785]
Debianlibsoup3sourcetrixie(unfixed)not yet assignedNot reported[1145785]
Debianlibsoup3sourcebookworm(unfixed)not yet assignedNot reported[1145785]
Debianlibsoup2.4sourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianlibsoup2.4sourcebookworm(unfixed)not yet assignedNot reportedNot reported
Ubuntulibsoup2.4debnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntulibsoup3debnoble3.4.4-5ubuntu0.9Not reportedNot reportedNot reported
Ubuntugir1.2-soup-2.4debnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntugir1.2-soup-3.0debnoble3.4.4-5ubuntu0.9Not reportedNot reportedNot reported
Ubuntulibsoup-2.4-1debnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-0debnoble3.4.4-5ubuntu0.9Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-commondebnoble3.4.4-5ubuntu0.9Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-devdebnoble3.4.4-5ubuntu0.9Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-docdebnoble3.4.4-5ubuntu0.9Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-testsdebnoble3.4.4-5ubuntu0.9Not reportedNot reportedNot reported
Ubuntulibsoup-gnome-2.4-1debnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntulibsoup-gnome2.4-devdebnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntulibsoup2.4-commondebnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntulibsoup2.4-devdebnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntulibsoup2.4-docdebnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntulibsoup2.4-testsdebnoble2.74.3-6ubuntu1.9Not reportedNot reportedNot reported
Ubuntulibsoup2.4debpro2.74.3-10.1ubuntu5+esm3Not reportedUBUNTU-CVE-2026-77680Not reported
Ubuntulibsoup2.4deb22.042.74.2-3ubuntu0.9Not reportedUBUNTU-CVE-2026-77680Not reported
Ubuntulibsoup3debpro3.0.7-0ubuntu1+esm9Not reportedUBUNTU-CVE-2026-77680Not reported
Ubuntulibsoup2.4deb24.042.74.3-6ubuntu1.9Not reportedUBUNTU-CVE-2026-77680Not reported
Ubuntulibsoup3deb24.043.4.4-5ubuntu0.9Not reportedUBUNTU-CVE-2026-77680Not reported
Ubuntulibsoup3deb26.103.6.6-1ubuntu3Not reportedUBUNTU-CVE-2026-77680Not reported
Ubuntulibsoup3deb26.043.6.6-1ubuntu0.1Not reportedUBUNTU-CVE-2026-77680Not reported

[Debian bug #1145785]

Notes

[trixie] libsoup3: Minor issue [bookworm] libsoup3: Minor issue, DoS [trixie] libsoup2.4: Minor issue [bookworm] libsoup2.4: Minor issue, DoS

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [gir1.2-soup-2.4]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • [gir1.2-soup-3.0]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [libsoup2.4-1]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • [libsoup2.4-common]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · all · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · all · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • [libsoup2.4-dev]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • [libsoup2.4-doc]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · all · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · all · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • [libsoup2.4-tests]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • [libsoup-3.0-0]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [libsoup-3.0-common]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [libsoup-3.0-dev]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [libsoup-3.0-doc]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [libsoup-3.0-tests]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [libsoup-gnome2.4-1]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • [libsoup-gnome2.4-dev]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

[Debian 13 (Trixie)]

  • [gir1.2-soup-2.4]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-10.1 · amd64 · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · arm64 · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

  • [gir1.2-soup-3.0]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.6.5-3 · amd64 · trixie

      Affected

      nvd · libsoup3 · debian · 13

    • 3.6.5-3 · arm64 · trixie

      Affected

      nvd · libsoup3 · debian · 13

  • [libsoup-2.4-1]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-10.1 · amd64 · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · arm64 · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

  • [libsoup2.4-common]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-10.1 · all · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · all · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

  • [libsoup2.4-dev]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-10.1 · amd64 · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · arm64 · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

  • [libsoup2.4-doc]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-10.1 · all · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · all · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

Next results

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]