The libsoup library, which provides HTTP client and server functionality for GNOME, contains two stack-based buffer overflow vulnerabilities. CVE-2026-0719 is caused by a signed to unsigned conversion error in the NTLM authentication code path, leading to a buffer overflow. CVE-2026-1761 involves a stack-based buffer overflow during multipart HTTP response parsing. Both vulnerabilities are rated as important by Red Hat and affect Red Hat Enterprise Linux 7 Extended Lifecycle Support. Security updates have been issued to fix these issues as detailed in Red Hat Advisory RHSA-2026:2628.

Successful exploitation of these vulnerabilities could result in stack-based buffer overflows, potentially leading to memory corruption, application crashes, or arbitrary code execution within the context of the affected application using libsoup. The vulnerabilities affect the NTLM authentication mechanism and multipart HTTP response parsing, which are critical components in HTTP communications. No known exploits in the wild have been reported at this time.

Red Hat has released security updates for libsoup in Red Hat Enterprise Linux 7 Extended Lifecycle Support to address these vulnerabilities. Users should apply the available patches as described in Red Hat Advisory RHSA-2026:2628 and the update instructions at https://access.redhat.com/articles/11258. No additional mitigation actions are indicated by the vendor advisory.