Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.8
GNOME libsoup HTTP Library Security Risk from Malicious Requests
published 4 months ago
Summary
A security update is available for GNOME's libsoup library, which is used by some applications to connect to the internet. This update fixes a flaw that could allow an attacker to bypass security controls or gain unauthorized access to a system. To stay secure, update to the latest version of libsoup.
What to do
- Update openeuler libsoup to version 2.74.2-18.oe2203sp4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openEuler:22.03-LTS-SP4 | openeuler | libsoup |
< 2.74.2-18.oe2203sp4 Fix: upgrade to 2.74.2-18.oe2203sp4
|
Original advisory text
libsoup security update
libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.
Security Fix(es):
A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the `soup_body_input_stream_read_chunked()` function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.(CVE-2026-6324)
Security Fix(es):
A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the `soup_body_input_stream_read_chunked()` function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.(CVE-2026-6324)
References
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-6324 Vendor Advisory
Severity
4.8
Medium
Timeline
Published12 Jun 2026
Updated21 Aug 2026
First seen12 Jun 2026
Sources
OESA-2026-2616 · OSV
Track software like this
Free during beta