The libsoup library in Red Hat Enterprise Linux 8 contains two stack-based buffer overflow vulnerabilities. CVE-2026-0719 is caused by a signed to unsigned conversion error in the NTLM authentication code path, which can lead to memory corruption. CVE-2026-1761 involves a stack-based buffer overflow triggered by specially crafted multipart HTTP responses. Both vulnerabilities could potentially be exploited to cause denial of service or code execution. Red Hat has issued an important security advisory (RHSA-2026:2215) with updated packages to fix these issues.

Successful exploitation of these vulnerabilities could result in a stack-based buffer overflow, potentially allowing an attacker to execute arbitrary code or cause a denial of service in applications using libsoup for HTTP communications. The vulnerabilities affect the NTLM authentication mechanism and multipart response parsing, which are common operations in HTTP clients and servers relying on libsoup.

Red Hat has released updated libsoup packages (version 2.62.3-13.el8_10) for Red Hat Enterprise Linux 8 and its Extended Life Cycle variants that address these vulnerabilities. Users should apply these official patches promptly by following the update instructions in the Red Hat advisory RHSA-2026:2215 and the referenced article https://access.redhat.com/articles/11258. No alternative mitigations or workarounds are indicated in the advisory.