Red Hat Security Advisory: libsoup3 security update
Two stack-based buffer overflow vulnerabilities have been identified in libsoup3, an HTTP library used by GNOME applications for asynchronous HTTP communication. The first vulnerability (CVE-2026-0719) arises from a signed to unsigned conversion error in NTLM authentication. The second (CVE-2026-1761) involves buffer overflow during multipart HTTP response parsing. These issues affect Red Hat Enterprise Linux 10 and related CodeReady Linux Builder packages. Red Hat has released security updates addressing these vulnerabilities.
AI Analysis
Technical Summary
Libsoup3, a C-based HTTP library designed for asynchronous network communication in GNOME applications, contains two stack-based buffer overflow vulnerabilities. CVE-2026-0719 arises from a signed to unsigned conversion error in NTLM authentication, while CVE-2026-1761 involves buffer overflow during multipart HTTP response parsing. Both vulnerabilities could lead to memory corruption. Red Hat has released security updates for Red Hat Enterprise Linux 10 and associated CodeReady Linux Builder packages to fix these issues as detailed in advisory RHSA-2026:2182.
Potential Impact
The vulnerabilities allow for stack-based buffer overflows, which could potentially be exploited to cause application crashes or execute arbitrary code within the context of the affected application. The advisory rates the security impact as Important (high severity). No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released updated libsoup3 packages for Red Hat Enterprise Linux 10 and related CodeReady Linux Builder variants that address these vulnerabilities. Users should apply the security updates as described in Red Hat advisory RHSA-2026:2182 and the referenced article https://access.redhat.com/articles/11258. Patch status is confirmed as fixed in libsoup3 version 3.6.5-3.el10_1.9 and later. No additional mitigations are specified by the vendor.
Red Hat Security Advisory: libsoup3 security update
Description
Two stack-based buffer overflow vulnerabilities have been identified in libsoup3, an HTTP library used by GNOME applications for asynchronous HTTP communication. The first vulnerability (CVE-2026-0719) arises from a signed to unsigned conversion error in NTLM authentication. The second (CVE-2026-1761) involves buffer overflow during multipart HTTP response parsing. These issues affect Red Hat Enterprise Linux 10 and related CodeReady Linux Builder packages. Red Hat has released security updates addressing these vulnerabilities.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Libsoup3, a C-based HTTP library designed for asynchronous network communication in GNOME applications, contains two stack-based buffer overflow vulnerabilities. CVE-2026-0719 arises from a signed to unsigned conversion error in NTLM authentication, while CVE-2026-1761 involves buffer overflow during multipart HTTP response parsing. Both vulnerabilities could lead to memory corruption. Red Hat has released security updates for Red Hat Enterprise Linux 10 and associated CodeReady Linux Builder packages to fix these issues as detailed in advisory RHSA-2026:2182.
Potential Impact
The vulnerabilities allow for stack-based buffer overflows, which could potentially be exploited to cause application crashes or execute arbitrary code within the context of the affected application. The advisory rates the security impact as Important (high severity). No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released updated libsoup3 packages for Red Hat Enterprise Linux 10 and related CodeReady Linux Builder variants that address these vulnerabilities. Users should apply the security updates as described in Red Hat advisory RHSA-2026:2182 and the referenced article https://access.redhat.com/articles/11258. Patch status is confirmed as fixed in libsoup3 version 3.6.5-3.el10_1.9 and later. No additional mitigations are specified by the vendor.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:2182
- Cve Count
- 2
- Additional Cves
- ["CVE-2026-1761"]
- Cvss Version
- null
Threat ID: 6a27e99e8dd33fbd8516c89d
Added to database: 6/9/2026, 10:23:26 AM
Last enriched: 6/9/2026, 10:47:30 AM
Last updated: 6/10/2026, 6:40:42 AM
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.