The libsoup library, which provides HTTP client and server functionality for GNOME, contains two distinct stack-based buffer overflow vulnerabilities. CVE-2026-0719 is caused by a signed to unsigned conversion error in the NTLM authentication component, potentially leading to memory corruption. CVE-2026-1761 arises from improper handling of multipart HTTP response parsing, also resulting in a stack-based buffer overflow. Both vulnerabilities are rated with high severity by Red Hat Product Security and affect libsoup versions included in Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat has released patched versions of libsoup to remediate these issues.

Successful exploitation of these vulnerabilities could lead to stack-based buffer overflows, which may allow an attacker to execute arbitrary code or cause a denial of service in applications using the vulnerable libsoup library. The vulnerabilities affect network-facing components related to HTTP authentication and response parsing, increasing the risk in environments where libsoup processes untrusted HTTP data.

Red Hat has released updated libsoup packages addressing these vulnerabilities as part of Red Hat Enterprise Linux 9.6 Extended Update Support. Users should apply the official security updates provided by Red Hat as detailed in advisory RHSA-2026:2049 and the referenced article https://access.redhat.com/articles/11258. Applying these updates will remediate the vulnerabilities. No additional mitigation steps are indicated by the vendor advisory.