Описание
Security update for libsoup2
This update for libsoup2 fixes the following issues:
- CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch (bsc#1272195).
- CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol violation (bsc#1271446).
- CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak (bsc#1271448).
- CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers via an oversized multipart boundary string (bsc#1271449).
- CVE-2026-66339: proxy credentials leak to destination server via
Proxy-Authorizationheader in CONNECT tunnels (bsc#1273156). - CVE-2026-77014: Integer truncation in sort_ranges() comparator causes silent omission of HTTP Range responses (bsc#1275988).
- CVE-2026-77680: quadratic CPU denial of service in HTTP Range coalescing after the CVE-2025-32907 fix (bsc#1276759).
- CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).
- CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).
- CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).
- CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).
- CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).
- CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling (bsc#1283831).
Список пакетов
SUSE Linux Enterprise Module for Basesystem 15 SP7
SUSE Linux Enterprise Server 15 SP6-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP6
Ссылки
- Link for SUSE-SU-2026:4703-1
- E-Mail link for SUSE-SU-2026:4703-1
- SUSE Security Ratings
- SUSE Bug 1271446
- SUSE Bug 1271448
- SUSE Bug 1271449
- SUSE Bug 1272195
- SUSE Bug 1273156
- SUSE Bug 1275988
- SUSE Bug 1276759
- SUSE Bug 1283300
- SUSE Bug 1283301
- SUSE Bug 1283302
- SUSE Bug 1283303
- SUSE Bug 1283304
- SUSE Bug 1283831
- SUSE CVE CVE-2026-102556 page
- SUSE CVE CVE-2026-102557 page
- SUSE CVE CVE-2026-102558 page
- SUSE CVE CVE-2026-102559 page
Описание
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.
Затронутые продукты
Ссылки
- CVE-2026-102556
- SUSE Bug 1283300
Описание
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash.
Затронутые продукты
Ссылки
- CVE-2026-102557
- SUSE Bug 1283301
Описание
A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data.
Затронутые продукты
Ссылки
- CVE-2026-102558
- SUSE Bug 1283302
Описание
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.
Затронутые продукты
Ссылки
- CVE-2026-102559
- SUSE Bug 1283303
Описание
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.
Затронутые продукты
Ссылки
- CVE-2026-102560
- SUSE Bug 1283304
Описание
A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled request, leading to unintended request handling.
Затронутые продукты
Ссылки
- CVE-2026-103399
- SUSE Bug 1283831
Описание
SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.
Затронутые продукты
Ссылки
- CVE-2026-12547
- SUSE Bug 1272195
Описание
A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.
Затронутые продукты
Ссылки
- CVE-2026-12548
- SUSE Bug 1272196
Описание
A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 <paragraph>5.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or less. A remote, unauthenticated attacker can exploit this by sending a non-compliant, oversized control frame. Because the parser handles this protocol violation improperly instead of throwing an immediate connection termination error, it triggers a internal processing crash, resulting in a remote denial of service (DoS) for applications utilizing libsoup WebSockets.
Затронутые продукты
Ссылки
- CVE-2026-15711
- SUSE Bug 1271446
Описание
A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated attacker acting as a malicious network peer can trick the connection engine into allocating stream states that are subsequently leaked during cleanup. Over a sustained period, this flaw allows the remote attacker to consume the system's heap allocations incrementally, triggering a denial of service (DoS) through an ultimate Out-of-Memory (OOM) application crash.
Затронутые продукты
Ссылки
- CVE-2026-15713
- SUSE Bug 1271448
Описание
An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists in the soup_multipart_input_stream_read_headers() function inside soup-multipart-input-stream.c, which does not adequately restrict or validate the size of incoming multipart boundary strings. When processing a crafted HTTP response containing a malformed or oversized boundary parameter, the internal stream reader reads past the allocated buffer bounds. A remote, unauthenticated attacker can exploit this behavior to cause a service denial (DoS) through application failure or potentially read fragments of unauthorized memory metadata.
Затронутые продукты
Ссылки
- CVE-2026-15714
- SUSE Bug 1271449
Описание
A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.
Затронутые продукты
Ссылки
- CVE-2026-2708
- SUSE Bug 1258508
Описание
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.
Затронутые продукты
Ссылки
- CVE-2026-66339
- SUSE Bug 1273156
Описание
A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.
Затронутые продукты
Ссылки
- CVE-2026-77014
- SUSE Bug 1275988
Описание
An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N^2) work coalescing them into a single range. The vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required. The number of ranges is bounded only by the maximum request header size (~100 KiB), allowing roughly 25,000 ranges per request. Reporter measurements on libsoup HEAD containing the CVE-2025-32907 fix show ~90 ms single-core CPU per such request at the wire maximum, blocking the server's event loop for that duration. This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs. Affected: libsoup versions containing the CVE-2025-32907 fix but not merge request !550. Fixed upstream: MR !550 merged 2026-08-20, replacing per-element removal with O(N) in-place compaction and rejecting Range headers requesting more than 200 ranges. Upstream report: https://gitlab.gnome.org/GNOME/libsoup/-/issues/538 Related: CVE-2025-32907
Затронутые продукты
Ссылки
- CVE-2026-77680
- SUSE Bug 1276759