The libsoup library, which provides HTTP client and server functionality for GNOME, contains two stack-based buffer overflow vulnerabilities. CVE-2026-0719 arises from a signed to unsigned conversion error in NTLM authentication code, potentially leading to memory corruption. CVE-2026-1761 involves a stack-based buffer overflow triggered during multipart HTTP response parsing. Both vulnerabilities could allow an attacker to cause a denial of service or potentially execute arbitrary code. Red Hat has released updated libsoup packages for Red Hat Enterprise Linux 8.8 variants to remediate these issues.

Successful exploitation of these vulnerabilities could lead to stack-based buffer overflows, which may result in application crashes or potentially arbitrary code execution within the context of the affected application using libsoup. The vulnerabilities affect HTTP authentication and multipart response parsing, critical components in network communication. No known exploits in the wild have been reported at this time.

Red Hat has released updated libsoup packages for Red Hat Enterprise Linux 8.8 variants that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:1948 and the linked update instructions (https://access.redhat.com/articles/11258). No alternative mitigations are specified; applying the official update is the recommended remediation.