Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-2369: libsoup can expose data or crash apps
CVE-2026-2369 · published 6 months ago
Summary
The libsoup libraries used in several Debian packages and GNOME can mishandle empty data, which may let an attacker read private information or make the program stop working. This affects the Debian libsoup2.4, libsoup3, rootio-libsoup2.4, rootio-libsoup3 packages and the GNOME libsoup component. Update to the latest package versions provided by your Linux distribution to fix the issue.
What to do
- Update debian libsoup3 to version 3.6.6-1.
- Update debian rootio-libsoup2.4 to version 2.74.3-1+deb12u1.aikido.3.
- Update debian rootio-libsoup3 to version 3.6.5-3.root.io.1.
- Update debian rootio-libsoup3 to version 3.6.5-3.root.io.2.
- Update debian libsoup2.4 to version 2.74.3-1+deb12u1.aikido.2.
- Update debian rootio-libsoup2.4 to version 2.74.3-1+deb12u1.aikido.2.
- Update debian libsoup2.4 to version 2.74.3-1+deb12u1.aikido.3.
- Update debian libsoup3 to version 3.6.5-3.aikido.5.
- Update debian rootio-libsoup3 to version 3.6.5-3.aikido.5.
- Update debian libsoup3 to version 3.6.5-3.root.io.2.
- Update libsoup2.4 to version 2.74.3-1+deb12u1.aikido.5.
- Update rootio-libsoup2.4 to version 2.74.3-1+deb12u1.aikido.5.
- Update canonical libsoup2.4 to version 2.62.1-1ubuntu0.4+esm7.
- Update canonical libsoup2.4 to version 2.70.0-1ubuntu0.5+esm2.
- Update canonical libsoup2.4 to version 2.74.2-3ubuntu0.7.
- Update canonical libsoup2.4 to version 2.74.3-6ubuntu1.7.
- Update canonical libsoup2.4 to version 2.74.3-10.1ubuntu4.1.
- Update canonical libsoup2.4 to version 2.74.3-10.1ubuntu5+esm1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | libsoup2.4 | All versions |
| Debian:12 | debian | libsoup2.4 | All versions |
| Debian:13 | debian | libsoup2.4 | All versions |
| Debian:12 | debian | libsoup3 | All versions |
| Debian:13 | debian | libsoup3 | All versions |
| Debian:14 | debian | libsoup3 |
< 3.6.6-1 Fix: upgrade to 3.6.6-1
|
| Root:Debian:12 | debian | rootio-libsoup2.4 |
< 2.74.3-1+deb12u1.aikido.3 < 2.74.3-1+deb12u1.aikido.2 Fix: upgrade to 2.74.3-1+deb12u1.aikido.3
|
| – | gnome | libsoup |
All versions
cpe:2.3:a:gnome:libsoup:-:*:*:*:*:*:*:* |
| Root:Debian:13 | debian | rootio-libsoup3 |
< 3.6.5-3.root.io.1 < 3.6.5-3.root.io.2 < 3.6.5-3.aikido.5 Fix: upgrade to 3.6.5-3.root.io.1
|
| Root:Debian:12 | debian | libsoup2.4 |
< 2.74.3-1+deb12u1.aikido.2 < 2.74.3-1+deb12u1.aikido.3 Fix: upgrade to 2.74.3-1+deb12u1.aikido.2
|
| Root:Debian:13 | debian | libsoup3 |
< 3.6.5-3.aikido.5 < 3.6.5-3.root.io.2 Fix: upgrade to 3.6.5-3.aikido.5
|
| Root:Debian:12 | – | libsoup2.4 |
< 2.74.3-1+deb12u1.aikido.5 Fix: upgrade to 2.74.3-1+deb12u1.aikido.5
|
| Root:Debian:12 | – | rootio-libsoup2.4 |
< 2.74.3-1+deb12u1.aikido.5 Fix: upgrade to 2.74.3-1+deb12u1.aikido.5
|
| Ubuntu:Pro:18.04:LTS | canonical | libsoup2.4 |
< 2.62.1-1ubuntu0.4+esm7 Fix: upgrade to 2.62.1-1ubuntu0.4+esm7
|
| Ubuntu:Pro:20.04:LTS | canonical | libsoup2.4 |
< 2.70.0-1ubuntu0.5+esm2 Fix: upgrade to 2.70.0-1ubuntu0.5+esm2
|
| Ubuntu:22.04:LTS | canonical | libsoup2.4 |
< 2.74.2-3ubuntu0.7 Fix: upgrade to 2.74.2-3ubuntu0.7
|
| Ubuntu:Pro:22.04:LTS | canonical | libsoup3 | All versions |
| Ubuntu:24.04:LTS | canonical | libsoup2.4 |
< 2.74.3-6ubuntu1.7 Fix: upgrade to 2.74.3-6ubuntu1.7
|
| Ubuntu:25.10 | canonical | libsoup2.4 |
< 2.74.3-10.1ubuntu4.1 Fix: upgrade to 2.74.3-10.1ubuntu4.1
|
| Ubuntu:Pro:26.04:LTS | canonical | libsoup2.4 |
< 2.74.3-10.1ubuntu5+esm1 Fix: upgrade to 2.74.3-10.1ubuntu5+esm1
|
Original advisory text
CVE-2026-2369 in libsoup2.4 - Patched by Root
A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This can allow an attacker to potentially access sensitive information or cause an application level denial of service.
References
- https://access.redhat.com/security/cve/CVE-2026-2369
- https://bugzilla.redhat.com/show_bug.cgi?id=2439091
- https://gitlab.gnome.org/GNOME/libsoup/-/issues/498
- https://security-tracker.debian.org/tracker/CVE-2026-2369 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-2369 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-2369 Third Party Advisory
- https://ubuntu.com/security/notices/USN-8523-1 Vendor Advisory
Severity
9.1
Critical
CVSS 3.1: 6.5 (NVD)
CVSS 3.1: 9.1 (OSV)
Exploitation
EPSS <1%
Type
CWE-191Integer Underflow (Wrap or Wraparound)
Timeline
Published19 Mar 2026
Updated25 Sep 2026
First seen19 Mar 2026
Track software like this
Free during beta