The libsoup library versions included in Red Hat Enterprise Linux 7 Extended Lifecycle Support contain two stack-based buffer overflow vulnerabilities. CVE-2026-0719 arises from a signed to unsigned conversion error in the NTLM authentication code path, which can lead to memory corruption. CVE-2026-1761 is due to improper handling of multipart HTTP responses, resulting in a stack-based buffer overflow. These vulnerabilities are classified under CWE-121 (stack-based buffer overflow). Red Hat has released security updates to fix these issues in libsoup version 2.62.2-11.el7_9 for multiple architectures and platforms under RHEL 7 ELS.

Successful exploitation of these vulnerabilities could lead to stack-based buffer overflows, potentially allowing an attacker to execute arbitrary code or cause denial of service in applications using the vulnerable libsoup library. The vulnerabilities affect HTTP client and server functionality, including NTLM authentication and multipart response parsing. The security impact is rated as Important by Red Hat, indicating a high severity level but no confirmed exploits in the wild at this time.

Red Hat has released updated libsoup packages (version 2.62.2-11.el7_9) for Red Hat Enterprise Linux 7 Extended Lifecycle Support that address these vulnerabilities. Users should apply these official security updates promptly to remediate the issues. For detailed update instructions, refer to Red Hat's advisory and article at https://access.redhat.com/articles/11258. No additional mitigations or workarounds are specified by Red Hat.