Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

libsoup can be crashed by specially crafted data

published 1 month ago

Summary

The libsoup library used in Red Hat systems can be triggered to stop working if it receives malformed network data. This could cause applications that rely on it to become unavailable. Update the affected libsoup packages to the latest version to prevent the crash.

What to do

Update redhat libsoup-debuginfo to version 0:2.62.3-2.el8_6.10.
Update redhat libsoup-debugsource to version 0:2.62.3-2.el8_6.10.
Update redhat libsoup-devel to version 0:2.62.3-2.el8_6.10.
Update redhat libsoup to version 0:2.62.3-2.el8_6.10.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_aus:8.6::appstream	redhat	libsoup-debuginfo	< 0:2.62.3-2.el8_6.10 Fix: upgrade to 0:2.62.3-2.el8_6.10
Red Hat:rhel_aus:8.6::appstream	redhat	libsoup-debugsource	< 0:2.62.3-2.el8_6.10 Fix: upgrade to 0:2.62.3-2.el8_6.10
Red Hat:rhel_aus:8.6::appstream	redhat	libsoup-devel	< 0:2.62.3-2.el8_6.10 Fix: upgrade to 0:2.62.3-2.el8_6.10
Red Hat:rhel_eus_long_life:8.6::appstream	redhat	libsoup-debuginfo	< 0:2.62.3-2.el8_6.10 Fix: upgrade to 0:2.62.3-2.el8_6.10
Red Hat:rhel_eus_long_life:8.6::appstream	redhat	libsoup-debugsource	< 0:2.62.3-2.el8_6.10 Fix: upgrade to 0:2.62.3-2.el8_6.10
Red Hat:rhel_eus_long_life:8.6::appstream	redhat	libsoup-devel	< 0:2.62.3-2.el8_6.10 Fix: upgrade to 0:2.62.3-2.el8_6.10
Red Hat:rhel_aus:8.6::baseos	redhat	libsoup	< 0:2.62.3-2.el8_6.10 Fix: upgrade to 0:2.62.3-2.el8_6.10
Red Hat:rhel_aus:8.6::baseos	redhat	libsoup-debuginfo	< 0:2.62.3-2.el8_6.10 Fix: upgrade to 0:2.62.3-2.el8_6.10
Red Hat:rhel_aus:8.6::baseos	redhat	libsoup-debugsource	< 0:2.62.3-2.el8_6.10 Fix: upgrade to 0:2.62.3-2.el8_6.10
Red Hat:rhel_eus_long_life:8.6::baseos	redhat	libsoup	< 0:2.62.3-2.el8_6.10 Fix: upgrade to 0:2.62.3-2.el8_6.10
Red Hat:rhel_eus_long_life:8.6::baseos	redhat	libsoup-debuginfo	< 0:2.62.3-2.el8_6.10 Fix: upgrade to 0:2.62.3-2.el8_6.10
Red Hat:rhel_eus_long_life:8.6::baseos	redhat	libsoup-debugsource	< 0:2.62.3-2.el8_6.10 Fix: upgrade to 0:2.62.3-2.el8_6.10

Original advisory text

Red Hat Security Advisory: libsoup security update

References

https://access.redhat.com/errata/RHSA-2026:70598 Vendor Advisory
https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2499922 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2499924 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70598.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-15709 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-15709 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-15709 Vendor Advisory
https://gitlab.gnome.org/GNOME/libsoup/-/issues/511 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-15711 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-15711 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-15711 Vendor Advisory
https://gitlab.gnome.org/GNOME/libsoup/-/issues/515 Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published23 Sep 2026

Updated23 Sep 2026

First seen23 Sep 2026

Sources

RHSA-2026:70598 · OSV

Track software like this

Free during beta