CVE-2026-0719 is a stack-based buffer overflow vulnerability in the libsoup HTTP library's NTLM authentication code. The vulnerability arises from a signed to unsigned integer conversion error during size calculation for extremely long passwords, causing an integer overflow. This leads to incorrect memory allocation on the stack and unsafe memory copying operations, which may cause applications using libsoup to crash unexpectedly, resulting in denial-of-service. The issue affects Red Hat Enterprise Linux versions 8.8 (>=8.8 <8.8.8) and 9.2 (>=9.2 <9.2.10). Red Hat has released security patches to fix this flaw, as detailed in their advisories RHSA-2026:1948 and RHSA-2026:2005.

The vulnerability can cause denial-of-service by crashing applications that use the libsoup library for NTLM authentication when processing specially crafted long passwords. Confidentiality and integrity impacts are rated low, but availability impact is high due to potential application crashes. There are no known exploits in the wild at this time.

Red Hat has released official security updates that fix this vulnerability in libsoup for Red Hat Enterprise Linux 8.8 and 9.2. Users should apply the updates as described in Red Hat advisories RHSA-2026:1948 and RHSA-2026:2005. Patch availability is confirmed and remediation is via official fixes. No additional mitigation actions are required beyond applying these updates.