The libsoup library, which provides HTTP client and server functionality for GNOME, contains two stack-based buffer overflow vulnerabilities. CVE-2026-0719 arises from a signed to unsigned conversion error in the NTLM authentication mechanism, potentially leading to memory corruption. CVE-2026-1761 involves a stack-based buffer overflow during the parsing of multipart HTTP responses. These vulnerabilities affect Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions across multiple architectures (ppc64le, x86_64, aarch64, s390x). Red Hat has released updated packages (libsoup-2.72.0-8.el9_0.9) to address these issues as detailed in advisory RHSA-2026:2008.

Successful exploitation of these vulnerabilities could lead to stack-based buffer overflows, which may cause application crashes or potentially allow execution of arbitrary code within the context of the affected application. The vulnerabilities impact the libsoup library used in HTTP client and server operations, which could affect applications relying on this library for network communications. The advisory rates the security impact as Important (high severity). There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated libsoup packages (version 2.72.0-8.el9_0.9) for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions that address these vulnerabilities. Users should apply the security update promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patch.