The libsoup library contains a vulnerability (CVE-2026-66337) due to an unsigned integer underflow in the soup_filter_input_stream_read_until() function. This underflow results in a heap buffer over-read during the parsing of multipart HTTP responses. An attacker controlling an HTTP server can exploit this by sending a specially crafted multipart response, which may cause the client application using libsoup to crash or leak sensitive heap memory contents. The vulnerability is classified under CWE-125 (Out-of-bounds Read) and has a CVSS 3.1 vector indicating network attack vector, low attack complexity, no privileges or user interaction required, with impact on confidentiality (partial) and availability (partial). No known exploits in the wild have been reported. No affected versions or patches are explicitly stated in the provided data.

Exploitation of this vulnerability can lead to client application crashes and potential disclosure of sensitive heap memory, which may expose confidential information. The impact affects confidentiality and availability but not integrity. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The provided Red Hat advisory link does not specify a fix or mitigation steps. Users should monitor official vendor advisories for updates and apply patches once available. Until then, caution is advised when interacting with untrusted HTTP servers sending multipart responses.