The libsoup library used in Red Hat Enterprise Linux 9 contains two stack-based buffer overflow vulnerabilities. CVE-2026-0719 arises from a signed to unsigned conversion error in the NTLM authentication code path, potentially leading to memory corruption. CVE-2026-1761 involves a stack-based buffer overflow triggered by malformed multipart HTTP responses. These vulnerabilities could be exploited to cause crashes or potentially execute arbitrary code. Red Hat has released updated libsoup packages to fix these issues as detailed in advisory RHSA-2026:2216.

Successful exploitation of these vulnerabilities could lead to denial of service or arbitrary code execution due to stack-based buffer overflows in the libsoup library. This affects applications relying on libsoup for HTTP client or server functionality, including those using NTLM authentication or processing multipart HTTP responses. The advisory rates the security impact as Important (high severity). There are no known exploits in the wild at the time of this advisory.

Red Hat has released updated libsoup packages for Red Hat Enterprise Linux 9 that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:2216 and the related article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor. Patch status is confirmed as fixed in libsoup-2.72.0-12.el9_7.5 and related packages.