Red Hat Security Advisory: libsoup security update
Two high-severity vulnerabilities have been identified in the libsoup HTTP client and server library used in GNOME, affecting Red Hat Enterprise Linux 9.2. The first vulnerability (CVE-2026-0719) involves a signed to unsigned conversion error that leads to a stack-based buffer overflow during NTLM authentication. The second vulnerability (CVE-2026-1761) is a stack-based buffer overflow in the multipart HTTP response parsing functionality. Red Hat has issued a security advisory with updated libsoup packages to address these issues.
AI Analysis
Technical Summary
The libsoup library in Red Hat Enterprise Linux 9.2 contains two stack-based buffer overflow vulnerabilities. CVE-2026-0719 arises from a signed to unsigned conversion error in the NTLM authentication code path, which can lead to memory corruption. CVE-2026-1761 is a stack-based buffer overflow triggered by malformed multipart HTTP response parsing. Both vulnerabilities could potentially be exploited to cause denial of service or arbitrary code execution. Red Hat has released updated libsoup packages (version 2.72.0-8.el9_2.10) that fix these issues.
Potential Impact
Successful exploitation of these vulnerabilities could allow an attacker to cause a stack-based buffer overflow, potentially leading to application crashes or arbitrary code execution within the context of the vulnerable libsoup library. This impacts applications relying on libsoup for HTTP client or server functionality, including GNOME components on affected Red Hat Enterprise Linux 9.2 systems.
Mitigation Recommendations
Red Hat has released updated libsoup packages (libsoup-2.72.0-8.el9_2.10) that address these vulnerabilities. Users of Red Hat Enterprise Linux 9.2 should apply the security update as described in Red Hat advisory RHSA-2026:2005 and the referenced article https://access.redhat.com/articles/11258. No alternative mitigations or workarounds are specified. Patch status is confirmed by the vendor advisory.
Red Hat Security Advisory: libsoup security update
Description
Two high-severity vulnerabilities have been identified in the libsoup HTTP client and server library used in GNOME, affecting Red Hat Enterprise Linux 9.2. The first vulnerability (CVE-2026-0719) involves a signed to unsigned conversion error that leads to a stack-based buffer overflow during NTLM authentication. The second vulnerability (CVE-2026-1761) is a stack-based buffer overflow in the multipart HTTP response parsing functionality. Red Hat has issued a security advisory with updated libsoup packages to address these issues.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The libsoup library in Red Hat Enterprise Linux 9.2 contains two stack-based buffer overflow vulnerabilities. CVE-2026-0719 arises from a signed to unsigned conversion error in the NTLM authentication code path, which can lead to memory corruption. CVE-2026-1761 is a stack-based buffer overflow triggered by malformed multipart HTTP response parsing. Both vulnerabilities could potentially be exploited to cause denial of service or arbitrary code execution. Red Hat has released updated libsoup packages (version 2.72.0-8.el9_2.10) that fix these issues.
Potential Impact
Successful exploitation of these vulnerabilities could allow an attacker to cause a stack-based buffer overflow, potentially leading to application crashes or arbitrary code execution within the context of the vulnerable libsoup library. This impacts applications relying on libsoup for HTTP client or server functionality, including GNOME components on affected Red Hat Enterprise Linux 9.2 systems.
Mitigation Recommendations
Red Hat has released updated libsoup packages (libsoup-2.72.0-8.el9_2.10) that address these vulnerabilities. Users of Red Hat Enterprise Linux 9.2 should apply the security update as described in Red Hat advisory RHSA-2026:2005 and the referenced article https://access.redhat.com/articles/11258. No alternative mitigations or workarounds are specified. Patch status is confirmed by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:2005
- Cve Count
- 2
- Additional Cves
- ["CVE-2026-1761"]
Threat ID: 6a27e99f8dd33fbd8516cc0a
Added to database: 06/09/2026, 10:23:27 UTC
Last enriched: 06/28/2026, 00:23:42 UTC
Last updated: 09/10/2026, 19:36:52 UTC
Views: 172
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.