The libsoup packages, which provide HTTP client and server functionality for GNOME, contain two stack-based buffer overflow vulnerabilities. CVE-2026-0719 arises from a signed to unsigned conversion error in the NTLM authentication code path, leading to a buffer overflow. CVE-2026-1761 involves a stack-based buffer overflow in the multipart HTTP response parsing logic. Both vulnerabilities are rated with an important security impact by Red Hat. The advisory RHSA-2026:2402 provides updated libsoup packages for Red Hat Enterprise Linux 8.4 AUS and EUS variants to remediate these issues.

Successful exploitation of these vulnerabilities could lead to stack-based buffer overflows, potentially causing application crashes or arbitrary code execution within the context of the vulnerable libsoup library. This could affect applications relying on libsoup for HTTP communication, including those using NTLM authentication or processing multipart HTTP responses. The severity is rated as important by Red Hat, indicating a high impact on affected systems.

Red Hat has released updated libsoup packages to address these vulnerabilities as detailed in advisory RHSA-2026:2402. Users of Red Hat Enterprise Linux 8.4 AUS and EUS variants should apply the available security updates promptly. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.