CVE-2026-85197

A use-after-free vulnerability was found in the libsoup library, in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server.

A flaw was found in libsoup where sending an HTTP/2 request body from a non-pollable input stream can lead to buffering more data than the flow-control window allows. A malicious server can shrink SETTINGS_INITIAL_WINDOW_SIZE while the buffered read is in progress, causing the client to copy the full buffer into a smaller DATA callback without bounds check, potentially aborting the process or failing the HTTP/2 session.

An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. The coalescing loop uses O(N²) operations when many identical ranges are supplied, allowing CPU exhaustion. The issue is reachable server-side without authentication and can block the event loop for ~90 ms per request at the wire maximum.

In libsoup, in SoupServer's HTTP Range header processing, the sort_ranges() comparator truncates a 64-bit subtraction result to 32-bit int, causing incorrect sorting for ranges on files larger than ~2 GB. This leads to omission of requested ranges in HTTP 206 Partial Content responses.

In libsoup, after establishing a CONNECT tunnel through an HTTP proxy, the Proxy-Authorization header is incorrectly attached to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials.

In libsoup, the chunked transfer encoding parser uses a permissive parsing function that accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests.

In libsoup, an unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can send a crafted response, causing the client application to crash or disclose sensitive heap memory.

A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.

An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The soup_multipart_input_stream_read_headers() function does not properly restrict the size of boundary strings, leading to a read past the allocated buffer. A remote unauthenticated attacker can exploit this to cause a denial of service (DoS) or potentially read unauthorized memory fragments.

A vulnerability in libsoup's HTTP/2 implementation causes improper memory release under specific stream termination conditions, such as window exhaustion or explicit stream resets. A remote unauthenticated attacker acting as a malicious network peer can force the connection engine to allocate stream states that are subsequently leaked during cleanup. Over time, this leads to heap exhaustion and an Out-of-Memory (OOM) crash, resulting in a denial of service (DoS).