The libsoup library, which provides HTTP client and server functionality for GNOME, contains two stack-based buffer overflow vulnerabilities. CVE-2026-0719 is caused by a signed to unsigned conversion error in the NTLM authentication code path, potentially leading to memory corruption. CVE-2026-1761 involves a stack-based buffer overflow during multipart HTTP response parsing. Both vulnerabilities affect libsoup packages distributed with Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions across multiple CPU architectures (ppc64le, x86_64, aarch64, s390x). Red Hat has issued security updates (libsoup-2.72.0-8.el9_0.9) to remediate these issues. The advisory classifies the impact as Important (high severity).

Successful exploitation of these vulnerabilities could result in stack-based buffer overflows, which may lead to memory corruption and potentially allow an attacker to execute arbitrary code or cause a denial of service. The vulnerabilities affect the libsoup library used in HTTP client and server operations, including NTLM authentication and multipart response parsing. No public exploits are currently known.

Red Hat has released updated libsoup packages (version 2.72.0-8.el9_0.9) that fix these vulnerabilities. Users of affected Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions should apply the available security updates promptly. Refer to the Red Hat article https://access.redhat.com/articles/11258 for detailed update instructions. No additional mitigation actions are indicated by the vendor advisory.