UnratedFix available
Security update for libsoup2
Type: advisorySources: OSV
This update for libsoup2 fixes the following issues: - CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch (bsc#1272195). - CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol violation (bsc#1271446). - CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak (bsc#1271448). - CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers via an oversized multipart boundary string (bsc#1271449). - CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT tunnels (bsc#1273156). - CVE-2026-77014: Integer truncation in sort_ranges() comparator causes silent omission of HTTP Range responses (bsc#1275988). - CVE-2026-77680: quadratic CPU denial of service in HTTP Range coalescing after the CVE-2025-32907 fix (bsc#1276759). - CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300). - CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301). - CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302). - CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303). - CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304). - CVE-2026-103399: in
- Products
- libsoup2
- Affected versions
- Not specified
- Fixed versions
- 2.74.3-150400.3.43.1
- CVEs
- CVE-2026-102556, CVE-2026-102557, CVE-2026-102558, CVE-2026-102559, CVE-2026-102560, CVE-2026-103399, CVE-2026-12547, CVE-2026-12548, CVE-2026-15711, CVE-2026-15713, CVE-2026-15714, CVE-2026-2708, CVE-2026-66339, CVE-2026-77014, CVE-2026-77680
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 09:36 UTC · Revision 1
Source evidence
This update for libsoup2 fixes the following issues: - CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch (bsc#1272195). - CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol violation (bsc#1271446). - CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak (bsc#1271448). - CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers via an oversized multipart boundary string (bsc#1271449). - CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT tunnels (bsc#1273156). - CVE-2026-77014: Integer truncation in sort_ranges() comparator causes silent omission of HTTP Range responses (bsc#1275988). - CVE-2026-77680: quadratic CPU denial of service in HTTP Range coalescing after the CVE-2025-32907 fix (bsc#1276759). - CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300). - CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301). - CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302). - CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303). - CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304). - CVE-2026-103399: in
osv:SUSE-SU-2026:4739-1
libsoup2
Fixed versions: 2.74.3-150400.3.43.1
libsoup2
Fixed versions: 2.74.3-150400.3.43.1
libsoup2
Fixed versions: 2.74.3-150400.3.43.1
libsoup2
Fixed versions: 2.74.3-150400.3.43.1
libsoup2
Fixed versions: 2.74.3-150400.3.43.1
libsoup2
Fixed versions: 2.74.3-150400.3.43.1
libsoup2
Fixed versions: 2.74.3-150400.3.43.1
libsoup2
Fixed versions: 2.74.3-150400.3.43.1
libsoup2
Fixed versions: 2.74.3-150400.3.43.1
libsoup2
Fixed versions: 2.74.3-150400.3.43.1
libsoup2
Fixed versions: 2.74.3-150400.3.43.1
Complete source record
{
"id": "9a5408fe0950428fc15329840ff5b934b85b402efd0eb129db18404145efa393",
"url": "https://osv.dev/vulnerability/SUSE-SU-2026%3A4739-1",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Security update for libsoup2",
"summary": "This update for libsoup2 fixes the following issues: - CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch (bsc#1272195). - CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol violation (bsc#1271446). - CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak (bsc#1271448). - CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers via an oversized multipart boundary string (bsc#1271449). - CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT tunnels (bsc#1273156). - CVE-2026-77014: Integer truncation in sort_ranges() comparator causes silent omission of HTTP Range responses (bsc#1275988). - CVE-2026-77680: quadratic CPU denial of service in HTTP Range coalescing after the CVE-2025-32907 fix (bsc#1276759). - CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300). - CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301). - CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302). - CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303). - CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304). - CVE-2026-103399: in",
"evidence": "osv:SUSE-SU-2026:4739-1",
"products": [
{
"name": {
"value": "libsoup2",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.74.3-150400.3.43.1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libsoup2",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.74.3-150400.3.43.1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libsoup2",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.74.3-150400.3.43.1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libsoup2",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.74.3-150400.3.43.1",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libsoup2",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.74.3-150400.3.43.1",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libsoup2",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.74.3-150400.3.43.1",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libsoup2",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.74.3-150400.3.43.1",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libsoup2",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.74.3-150400.3.43.1",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libsoup2",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.74.3-150400.3.43.1",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libsoup2",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.74.3-150400.3.43.1",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libsoup2",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.74.3-150400.3.43.1",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "SUSE-SU-2026:4739-1",
"aliases": [
"SUSE-SU-2026:4739-1"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.74.3-150400.3.43.1"
}
]
}
],
"package": {
"name": "libsoup2",
"purl": "pkg:rpm/suse/libsoup2&distro=SUSE%20Linux%20Enterprise%20Micro%205.3",
"ecosystem": "SUSE:Linux Enterprise Micro 5.3"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4739-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libsoup-2_4-1": "2.74.3-150400.3.43.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.74.3-150400.3.43.1"
}
]
}
],
"package": {
"name": "libsoup2",
"purl": "pkg:rpm/suse/libsoup2&distro=SUSE%20Linux%20Enterprise%20Micro%205.4",
"ecosystem": "SUSE:Linux Enterprise Micro 5.4"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4739-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libsoup-2_4-1": "2.74.3-150400.3.43.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.74.3-150400.3.43.1"
}
]
}
],
"package": {
"name": "libsoup2",
"purl": "pkg:rpm/suse/libsoup2&distro=SUSE%20Linux%20Enterprise%20Micro%205.5",
"ecosystem": "SUSE:Linux Enterprise Micro 5.5"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4739-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libsoup-2_4-1": "2.74.3-150400.3.43.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.74.3-150400.3.43.1"
}
]
}
],
"package": {
"name": "libsoup2",
"purl": "pkg:rpm/suse/libsoup2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS",
"ecosystem": "SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4739-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libsoup-2_4-1": "2.74.3-150400.3.43.1",
"libsoup2-lang": "2.74.3-150400.3.43.1",
"libsoup2-devel": "2.74.3-150400.3.43.1",
"typelib-1_0-Soup-2_4": "2.74.3-150400.3.43.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.74.3-150400.3.43.1"
}
]
}
],
"package": {
"name": "libsoup2",
"purl": "pkg:rpm/suse/libsoup2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS",
"ecosystem": "SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4739-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libsoup-2_4-1": "2.74.3-150400.3.43.1",
"libsoup2-lang": "2.74.3-150400.3.43.1",
"libsoup2-devel": "2.74.3-150400.3.43.1",
"typelib-1_0-Soup-2_4": "2.74.3-150400.3.43.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.74.3-150400.3.43.1"
}
]
}
],
"package": {
"name": "libsoup2",
"purl": "pkg:rpm/suse/libsoup2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS",
"ecosystem": "SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4739-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libsoup-2_4-1": "2.74.3-150400.3.43.1",
"libsoup2-lang": "2.74.3-150400.3.43.1",
"libsoup2-devel": "2.74.3-150400.3.43.1",
"typelib-1_0-Soup-2_4": "2.74.3-150400.3.43.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.74.3-150400.3.43.1"
}
]
}
],
"package": {
"name": "libsoup2",
"purl": "pkg:rpm/suse/libsoup2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS",
"ecosystem": "SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4739-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libsoup-2_4-1": "2.74.3-150400.3.43.1",
"libsoup2-lang": "2.74.3-150400.3.43.1",
"libsoup2-devel": "2.74.3-150400.3.43.1",
"typelib-1_0-Soup-2_4": "2.74.3-150400.3.43.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.74.3-150400.3.43.1"
}
]
}
],
"package": {
"name": "libsoup2",
"purl": "pkg:rpm/suse/libsoup2&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS",
"ecosystem": "SUSE:Linux Enterprise Server 15 SP4-LTSS"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4739-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libsoup-2_4-1": "2.74.3-150400.3.43.1",
"libsoup2-lang": "2.74.3-150400.3.43.1",
"libsoup2-devel": "2.74.3-150400.3.43.1",
"typelib-1_0-Soup-2_4": "2.74.3-150400.3.43.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.74.3-150400.3.43.1"
}
]
}
],
"package": {
"name": "libsoup2",
"purl": "pkg:rpm/suse/libsoup2&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS",
"ecosystem": "SUSE:Linux Enterprise Server 15 SP5-LTSS"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4739-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libsoup-2_4-1": "2.74.3-150400.3.43.1",
"libsoup2-lang": "2.74.3-150400.3.43.1",
"libsoup2-devel": "2.74.3-150400.3.43.1",
"typelib-1_0-Soup-2_4": "2.74.3-150400.3.43.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.74.3-150400.3.43.1"
}
]
}
],
"package": {
"name": "libsoup2",
"purl": "pkg:rpm/suse/libsoup2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4",
"ecosystem": "SUSE:Linux Enterprise Server for SAP Applications 15 SP4"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4739-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libsoup-2_4-1": "2.74.3-150400.3.43.1",
"libsoup2-lang": "2.74.3-150400.3.43.1",
"libsoup2-devel": "2.74.3-150400.3.43.1",
"typelib-1_0-Soup-2_4": "2.74.3-150400.3.43.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.74.3-150400.3.43.1"
}
]
}
],
"package": {
"name": "libsoup2",
"purl": "pkg:rpm/suse/libsoup2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5",
"ecosystem": "SUSE:Linux Enterprise Server for SAP Applications 15 SP5"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4739-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libsoup-2_4-1": "2.74.3-150400.3.43.1",
"libsoup2-lang": "2.74.3-150400.3.43.1",
"libsoup2-devel": "2.74.3-150400.3.43.1",
"typelib-1_0-Soup-2_4": "2.74.3-150400.3.43.1"
}
]
}
}
],
"modified": "2026-10-20T10:45:04.185304919Z",
"provider": "osv",
"upstream": [
"CVE-2026-102556",
"CVE-2026-102557",
"CVE-2026-102558",
"CVE-2026-102559",
"CVE-2026-102560",
"CVE-2026-103399",
"CVE-2026-12547",
"CVE-2026-12548",
"CVE-2026-15711",
"CVE-2026-15713",
"CVE-2026-15714",
"CVE-2026-2708",
"CVE-2026-66339",
"CVE-2026-77014",
"CVE-2026-77680"
],
"references": [
"https://www.suse.com/support/update/announcement/2026/suse-su-20264739-1/",
"https://bugzilla.suse.com/1271446",
"https://bugzilla.suse.com/1271448",
"https://bugzilla.suse.com/1271449",
"https://bugzilla.suse.com/1272195",
"https://bugzilla.suse.com/1273156",
"https://bugzilla.suse.com/1275988",
"https://bugzilla.suse.com/1276759",
"https://bugzilla.suse.com/1283300",
"https://bugzilla.suse.com/1283301",
"https://bugzilla.suse.com/1283302",
"https://bugzilla.suse.com/1283303",
"https://bugzilla.suse.com/1283304",
"https://bugzilla.suse.com/1283831",
"https://www.suse.com/security/cve/CVE-2026-102556",
"https://www.suse.com/security/cve/CVE-2026-102557",
"https://www.suse.com/security/cve/CVE-2026-102558",
"https://www.suse.com/security/cve/CVE-2026-102559",
"https://www.suse.com/security/cve/CVE-2026-102560",
"https://www.suse.com/security/cve/CVE-2026-103399",
"https://www.suse.com/security/cve/CVE-2026-12547",
"https://www.suse.com/security/cve/CVE-2026-12548",
"https://www.suse.com/security/cve/CVE-2026-15711",
"https://www.suse.com/security/cve/CVE-2026-15713",
"https://www.suse.com/security/cve/CVE-2026-15714",
"https://www.suse.com/security/cve/CVE-2026-2708",
"https://www.suse.com/security/cve/CVE-2026-66339",
"https://www.suse.com/security/cve/CVE-2026-77014",
"https://www.suse.com/security/cve/CVE-2026-77680"
]
},
"related_cves": [
{
"value": "CVE-2026-102556",
"evidence": "/upstream"
},
{
"value": "CVE-2026-102557",
"evidence": "/upstream"
},
{
"value": "CVE-2026-102558",
"evidence": "/upstream"
},
{
"value": "CVE-2026-102559",
"evidence": "/upstream"
},
{
"value": "CVE-2026-102560",
"evidence": "/upstream"
},
{
"value": "CVE-2026-103399",
"evidence": "/upstream"
},
{
"value": "CVE-2026-12547",
"evidence": "/upstream"
},
{
"value": "CVE-2026-12548",
"evidence": "/upstream"
},
{
"value": "CVE-2026-15711",
"evidence": "/upstream"
},
{
"value": "CVE-2026-15713",
"evidence": "/upstream"
},
{
"value": "CVE-2026-15714",
"evidence": "/upstream"
},
{
"value": "CVE-2026-2708",
"evidence": "/upstream"
},
{
"value": "CVE-2026-66339",
"evidence": "/upstream"
},
{
"value": "CVE-2026-77014",
"evidence": "/upstream"
},
{
"value": "CVE-2026-77680",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 379268,
"published_at": "2026-10-19T12:59:37+00:00"
}