CVE-2026-77680: Inefficient Algorithmic Complexity in Red Hat Red Hat Enterprise Linux 10

This vulnerability arises from an inefficient O(N²) algorithm in libsoup's HTTP Range header coalescing logic, where repeated identical ranges cause excessive CPU usage during server-side processing. The flaw persists after the CVE-2025-32907 fix, which addressed memory amplification but not the quadratic CPU complexity. The vulnerable code path is reachable without authentication when a SoupServer handler returns HTTP 200 with a non-empty body. The maximum number of ranges is limited by the request header size (~100 KiB), allowing roughly 25,000 ranges per request, which can block the server's event loop for about 90 ms per request on a single CPU core. The upstream fix replaces per-element removal with an O(N) in-place compaction and rejects Range headers with more than 200 ranges.

The vulnerability allows a remote attacker to cause CPU exhaustion on a server running vulnerable libsoup versions by sending crafted HTTP requests with many identical Range header values. This leads to reduced availability and degraded performance due to excessive CPU consumption. There is no impact on confidentiality or integrity, and no memory corruption or information disclosure occurs. The CVSS 3.1 base score is 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and low availability impact.

A fix is available upstream in libsoup via merge request !550, which implements an O(N) range coalescing algorithm and limits Range headers to 200 ranges. Users should upgrade to a libsoup version containing this fix. Until patched, mitigate by restricting network access to services using SoupServer or terminating connections that send Range headers with excessive range counts. No other mitigations are currently available.