This vulnerability is a regression of the fix for CVE-2026-2443 caused by a rework commit that replaced specific overflow checks with a general signed comparison. The issue arises when a client sends an HTTP Range request with a suffix length exceeding the content size, resulting in a negative start value that is not properly clamped. This causes malformed HTTP 206 responses and log flooding. The vulnerability has a CVSS 3.1 base score of 4.8 (medium severity) with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, low confidentiality impact, no integrity impact, and low availability impact. No known exploits are reported in the wild. The vendor advisory does not explicitly state a patch or remediation status.

The vulnerability can cause malformed HTTP 206 responses and flooding of logs, which may lead to limited denial of service conditions or resource exhaustion on affected systems. Confidentiality impact is low, with no integrity impact. Availability impact is low due to potential log flooding. There is no indication of privilege escalation or remote code execution.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-12549 for current remediation guidance. Since no official fix or temporary workaround is explicitly stated in the advisory content provided, users should monitor the vendor site for updates and apply patches once available. No vendor advisory states that no action is required or that the issue is already mitigated.