CVE-2026-77014 is a vulnerability in libsoup's SoupServer HTTP Range header processing where the sort_ranges() comparator truncates a 64-bit subtraction result to a 32-bit int. This truncation flips the sign for range offsets differing by more than INT_MAX, causing the server to silently omit requested byte ranges from HTTP 206 Partial Content responses on resources larger than about 2 GB. The flaw is classified as CWE-197 (Numeric Truncation Error) and impacts the integrity of the HTTP response by omitting requested data ranges without indication. Exploitation requires the server to serve large resources and can be triggered remotely without authentication or user interaction.

The vulnerability causes silent omission of requested byte ranges in HTTP 206 Partial Content responses, potentially leading to incomplete data delivery to clients. This affects the integrity of the served content but does not impact confidentiality or availability. The impact is limited to resources larger than approximately 2 GB, which restricts the real-world exploitation scope. No known exploits are reported in the wild.

According to the Red Hat advisory, no mitigation is currently available for this vulnerability. Users should monitor vendor advisories for any future patches or fixes. Since no official fix or workaround exists, affected systems should consider limiting exposure by avoiding serving large resources with vulnerable libsoup versions if possible. Red Hat is the authoritative source for updates regarding this issue.