libsoup

Two security vulnerabilities have been identified in the libsoup HTTP client and server library used in GNOME, affecting Red Hat Enterprise Linux 7 Extended Lifecycle Support. The first vulnerability (CVE-2026-0719) involves a signed to unsigned conversion error that leads to a stack-based buffer overflow in NTLM authentication. The second vulnerability (CVE-2026-1761) is a stack-based buffer overflow in multipart HTTP response parsing. These issues could potentially allow attackers to cause memory corruption. Red Hat has released security updates addressing these vulnerabilities.

Red Hat Security Advisory: libsoup security update

This advisory addresses two stack-based buffer overflow vulnerabilities in libsoup used by spice-client-win MSI installers for Windows clients. The first vulnerability (CVE-2026-0719) involves a signed to unsigned conversion error in NTLM authentication, and the second (CVE-2026-1761) concerns multipart HTTP response parsing. These issues could lead to memory corruption. Red Hat has issued security updates for spice-client-win on Red Hat Enterprise Linux 8.8 variants to fix these vulnerabilities.

Red Hat Security Advisory: spice-client-win security update

Two stack-based buffer overflow vulnerabilities have been identified in libsoup, affecting the spice-client-win MSI installers for Windows clients distributed with Red Hat Enterprise Linux 8.6 variants. The first vulnerability (CVE-2026-0719) arises from a signed to unsigned conversion error in NTLM authentication, and the second (CVE-2026-1761) involves multipart HTTP response parsing. Red Hat has issued security updates addressing these issues in spice-client-win packages for multiple Red Hat Enterprise Linux 8.6 update services. The vulnerabilities are rated as important by Red Hat Product Security.

spice-client-win

This security advisory addresses two stack-based buffer overflow vulnerabilities in libsoup used by the spice-client-win MSI installers for Windows clients. The first vulnerability (CVE-2026-0719) involves a signed to unsigned conversion error in libsoup NTLM authentication. The second vulnerability (CVE-2026-1761) involves a stack-based buffer overflow in libsoup multipart response parsing. These issues affect Red Hat Enterprise Linux 8.4 Extended Update Support and Advanced Update Support versions. Red Hat has released updated spice-client-win packages to fix these vulnerabilities.

The libsoup packages provide an HTTP client and server library for GNOME.

Security Fix(es):

* libsoup: Signed to Unsigned Conversion Error Leading to Stack-Based Buffer Overflow in libsoup NTLM Authentication (CVE-2026-0719)

* libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response (CVE-2026-1761)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This security advisory addresses two stack-based buffer overflow vulnerabilities in the libsoup library used by spice-client-win MSI installers for Windows clients. The first vulnerability (CVE-2026-0719) arises from a signed to unsigned conversion error in libsoup's NTLM authentication. The second vulnerability (CVE-2026-1761) involves a stack-based buffer overflow during multipart HTTP response parsing. These issues affect Red Hat Enterprise Linux 8.2 AUS versions of the spice-client-win package. Red Hat has released an important security update to address these vulnerabilities.

Two security vulnerabilities have been identified in the libsoup HTTP client and server library for GNOME, used in Red Hat Enterprise Linux 9. These include a signed to unsigned conversion error causing a stack-based buffer overflow in NTLM authentication (CVE-2026-0719) and a stack-based buffer overflow in multipart HTTP response parsing (CVE-2026-1761). Red Hat has issued an important security advisory with updates to address these issues. The vulnerabilities are rated as having important security impact, and updated libsoup packages are available for Red Hat Enterprise Linux 9 across multiple architectures.

Two stack-based buffer overflow vulnerabilities have been identified in libsoup, affecting the spice-client-win MSI installers for Windows clients on Red Hat Enterprise Linux 8. One vulnerability (CVE-2026-0719) is due to a signed to unsigned conversion error in NTLM authentication, and the other (CVE-2026-1761) occurs during multipart HTTP response parsing. Red Hat has released security updates addressing these issues for multiple architectures and extended life cycle versions of Red Hat Enterprise Linux 8.

libsoup3

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: Signed to Unsigned Conversion Error Leading to Stack-Based Buffer Overflow in libsoup NTLM Authentication (CVE-2026-0719)

* libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response (CVE-2026-1761)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: libsoup3 security update

Two security vulnerabilities have been identified in the libsoup HTTP client and server library used in GNOME, affecting Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. The first vulnerability (CVE-2026-0719) involves a signed to unsigned conversion error that leads to a stack-based buffer overflow in libsoup NTLM authentication. The second vulnerability (CVE-2026-1761) is a stack-based buffer overflow in libsoup multipart response parsing. Red Hat has released security updates addressing these issues in libsoup version 2.72.0-8.el9_0.9 for multiple architectures. These vulnerabilities are rated as having a high security impact by Red Hat. No known exploits in the wild have been reported at this time.

Two high-severity vulnerabilities have been identified in the libsoup HTTP client and server library used in GNOME, affecting Red Hat Enterprise Linux 9.2. The first vulnerability (CVE-2026-0719) involves a signed to unsigned conversion error that leads to a stack-based buffer overflow during NTLM authentication. The second vulnerability (CVE-2026-1761) is a stack-based buffer overflow in the multipart HTTP response parsing functionality. Red Hat has issued a security advisory with updated libsoup packages to address these issues.

Two stack-based buffer overflow vulnerabilities were found in the libsoup HTTP client and server library used by GNOME, affecting Red Hat Enterprise Linux 9.6 Extended Update Support and related packages. The first vulnerability (CVE-2026-0719) is due to a signed to unsigned conversion error in NTLM authentication. The second (CVE-2026-1761) occurs during multipart HTTP response parsing. Red Hat has issued updated libsoup packages to address these issues.

security update for libsoup

A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication. When processing extremely long passwords, an internal size calculation can overflow due to improper use of signed integers. This results in incorrect memory allocation on the stack, followed by unsafe memory copying. As a result, applications using libsoup may crash unexpectedly, creating a denial-of-service risk.

Search: CVE-2026-0719