Libsoup3, a C-based HTTP library used in GNOME applications, contains two stack-based buffer overflow vulnerabilities. CVE-2026-0719 arises from a signed to unsigned conversion error in the NTLM authentication code, potentially leading to memory corruption. CVE-2026-1761 involves a stack-based buffer overflow during multipart HTTP response parsing. Both vulnerabilities could be exploited to cause crashes or potentially execute arbitrary code. Red Hat has issued an important security advisory (RHSA-2026:2006) providing updated libsoup3 packages that fix these issues for Red Hat Enterprise Linux 10.0 Extended Update Support and associated CodeReady Linux Builder products.

The vulnerabilities allow stack-based buffer overflows in libsoup3, which could lead to application crashes or potentially arbitrary code execution if exploited. The affected component is used by GNOME applications for HTTP communication, so exploitation could impact applications relying on libsoup3 for network interactions. No known exploits in the wild have been reported. The severity is rated as high by the source advisory, indicating significant risk if unpatched.

Red Hat has released updated libsoup3 packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 10.0 Extended Update Support and related CodeReady Linux Builder products should apply the security updates as detailed in Red Hat advisory RHSA-2026:2006 and the referenced article https://access.redhat.com/articles/11258. Applying these official patches is the recommended mitigation. There is no indication that no action is required or that the issue is already mitigated without patching.