CVE-2026-66337

A use-after-free vulnerability was found in the libsoup library, in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server.

In libsoup, in SoupServer's HTTP Range header processing, the sort_ranges() comparator truncates a 64-bit subtraction result to 32-bit int, causing incorrect sorting for ranges on files larger than ~2 GB. This leads to omission of requested ranges in HTTP 206 Partial Content responses.

In libsoup, after establishing a CONNECT tunnel through an HTTP proxy, the Proxy-Authorization header is incorrectly attached to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials.

In libsoup, the chunked transfer encoding parser uses a permissive parsing function that accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests.

A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.

An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The soup_multipart_input_stream_read_headers() function does not properly restrict the size of boundary strings, leading to a read past the allocated buffer. A remote unauthenticated attacker can exploit this to cause a denial of service (DoS) or potentially read unauthorized memory fragments.

A vulnerability in libsoup's HTTP/2 implementation causes improper memory release under specific stream termination conditions, such as window exhaustion or explicit stream resets. A remote unauthenticated attacker acting as a malicious network peer can force the connection engine to allocate stream states that are subsequently leaked during cleanup. Over time, this leads to heap exhaustion and an Out-of-Memory (OOM) crash, resulting in a denial of service (DoS).

A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or less. A remote, unauthenticated attacker can exploit this by sending a non-compliant, oversized control frame, causing an internal processing crash and resulting in a remote denial of service (DoS) for applications utilizing libsoup WebSockets.

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The decompression loop processes data in chunks without enforcing an upper boundary limit on the output buffer size, allowing unbounded memory allocation. A remote, unauthenticated attacker can send a small, highly compressed payload (decompression bomb), causing an Out-of-Memory (OOM) crash and Denial of Service (DoS).

A heap buffer over-read vulnerability was discovered in libsoup versions 3.0 to 3.7.0 in the HTTP/2 GOAWAY frame handling. Missing length validation allows a remote unauthenticated attacker to send a malformed frame, causing application crash (DoS) or potential memory content leak.