[Git][security-tracker-team/security-tracker][master] Track fixes for libsoup3 via unstable
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Thu Oct 1 07:19:17 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
0012d83e by Salvatore Bonaccorso at 2026-10-01T08:18:42+02:00
Track fixes for libsoup3 via unstable
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -727,7 +727,7 @@ CVE-2026-103432 (apcupsd through 3.14.14 has an sscanf stack-based buffer overfl
- apcupsd <unfixed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2493140
CVE-2026-103399 (A flaw was found in SoupServer (libsoup). When an HTTP/1.x client send ...)
- - libsoup3 <unfixed>
+ - libsoup3 3.8.0-1
- libsoup2.4 <removed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543949
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/539
@@ -1838,7 +1838,7 @@ CVE-2026-102567 (CTranslate2 before 4.8.1 contains an out-of-bounds heap read vu
CVE-2026-102566 (CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the ...)
NOT-FOR-US: CTranslate2
CVE-2026-102560 (A flaw was found in libsoup. When the permessage-deflate WebSocket ext ...)
- - libsoup3 <unfixed>
+ - libsoup3 3.8.0-1
[trixie] - libsoup3 <no-dsa> (Minor issue)
- libsoup2.4 <removed>
[trixie] - libsoup2.4 <no-dsa> (Minor issue)
@@ -1846,7 +1846,7 @@ CVE-2026-102560 (A flaw was found in libsoup. When the permessage-deflate WebSoc
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/libsoup/-/commit/dbd0417ea3a569135e9a9344b7812076b7b178f1 (3.7.3)
CVE-2026-102559 (A flaw was found in libsoup. When constructing a masked WebSocket clie ...)
- - libsoup3 <unfixed>
+ - libsoup3 3.8.0-1
[trixie] - libsoup3 <no-dsa> (Minor issue)
- libsoup2.4 <removed>
[trixie] - libsoup2.4 <no-dsa> (Minor issue)
@@ -1854,25 +1854,25 @@ CVE-2026-102559 (A flaw was found in libsoup. When constructing a masked WebSock
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/libsoup/-/commit/d7f074f8c8c90216f2476522836287c6f80fc53e (3.7.3)
CVE-2026-102558 (A flaw was found in libsoup. When max-incoming-payload-size is unlimit ...)
- - libsoup3 <unfixed>
+ - libsoup3 3.8.0-1
- libsoup2.4 <removed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543274
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/libsoup/-/commit/381a474ff437d0f7573d2bb3e8d3027260ab584f (3.7.3)
CVE-2026-102557 (A flaw was found in libsoup. When reassembling fragmented WebSocket me ...)
- - libsoup3 <unfixed>
+ - libsoup3 3.8.0-1
- libsoup2.4 <removed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543231
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/libsoup/-/commit/d7f074f8c8c90216f2476522836287c6f80fc53e (3.7.3)
CVE-2026-102556 (A flaw was found in libsoup. When handling an incoming WebSocket Pong ...)
- - libsoup3 <unfixed>
+ - libsoup3 3.8.0-1
- libsoup2.4 <removed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543229
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/libsoup/-/commit/d2cbaf25f81a9ce041714cf842c366c67b0b873e (3.7.3)
CVE-2026-102555 (A flaw was found in libsoup. The soup_uri_decode_data_uri() function i ...)
- - libsoup3 <unfixed>
+ - libsoup3 3.8.0-1
- libsoup2.4 <removed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543224
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554
@@ -35241,7 +35241,7 @@ CVE-2026-85540 (DreamMaker developed by Interinfo has a SQL Injection vulnerabil
CVE-2026-85538 (An incorrect authorization vulnerability in MISP allowed authenticated ...)
- misp <itp> (bug #1144317)
CVE-2026-85534 (A flaw was found in libsoup. When a client sends an HTTP/2 request bod ...)
- - libsoup3 <unfixed> (bug #1146878)
+ - libsoup3 3.8.0-1 (bug #1146878)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <postponed> (Minor issue)
- libsoup2.4 <not-affected> (HTTP/2 support introduced in libsoup3)
@@ -35275,7 +35275,7 @@ CVE-2026-85311 (Missing Authorization vulnerability in Kings Plugins MarketKing
CVE-2026-85229 (** UNSUPPORTED WHEN ASSIGNED **Improper neutralization of input during ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85197 (A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the ...)
- - libsoup3 <unfixed> (bug #1146877)
+ - libsoup3 3.8.0-1 (bug #1146877)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <postponed> (Minor issue)
- libsoup2.4 <not-affected> (HTTP/2 support introduced in libsoup3)
@@ -47257,7 +47257,7 @@ CVE-2026-77694 (The Eventin WordPress plugin before 4.1.19 does not properly re
CVE-2026-77693 (The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not c ...)
NOT-FOR-US: WordPress plugin
CVE-2026-77680 (An algorithmic complexity flaw exists in libsoup's HTTP Range header p ...)
- - libsoup3 <unfixed> (bug #1145785)
+ - libsoup3 3.8.0-1 (bug #1145785)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <postponed> (Minor issue, DoS)
- libsoup2.4 <removed>
@@ -51364,7 +51364,7 @@ CVE-2026-77020 (A vulnerability was identified in CodeAstro Apartment Visitor Ma
CVE-2026-77019 (A vulnerability was determined in CodeAstro Apartment Visitor Manageme ...)
NOT-FOR-US: CodeAstro
CVE-2026-77014 (A flaw was found in libsoup's SoupServer HTTP Range header processing. ...)
- - libsoup3 <unfixed> (bug #1144976)
+ - libsoup3 3.8.0-1 (bug #1144976)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <postponed> (Minor issue, DoS)
- libsoup2.4 <removed>
@@ -84334,7 +84334,7 @@ CVE-2026-66373 (Redis before 8.8.0, in the unusual case where an authenticated a
NOTE: The same flaw in valkey is tracked in CVE-2026-63639, where valkey was affected and
NOTE: fixed it in 9.1.1-1
CVE-2026-66339 (A flaw was found in libsoup. After a CONNECT tunnel is established thr ...)
- - libsoup3 <unfixed> (bug #1142846)
+ - libsoup3 3.8.0-1 (bug #1142846)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <postponed> (Minor issue)
- libsoup2.4 <removed>
@@ -84343,7 +84343,7 @@ CVE-2026-66339 (A flaw was found in libsoup. After a CONNECT tunnel is establish
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2506951
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/534
CVE-2026-66338 (A flaw was found in libsoup. The chunked transfer encoding parser uses ...)
- - libsoup3 <unfixed> (bug #1142845)
+ - libsoup3 3.8.0-1 (bug #1142845)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <ignored> (Limited support, server unsupported)
- libsoup2.4 <removed>
@@ -84352,7 +84352,7 @@ CVE-2026-66338 (A flaw was found in libsoup. The chunked transfer encoding parse
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2506950
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/533
CVE-2026-66337 (A flaw was found in libsoup. An unsigned integer underflow in the soup ...)
- - libsoup3 <unfixed> (bug #1142844)
+ - libsoup3 3.8.0-1 (bug #1142844)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <postponed> (Minor issue)
- libsoup2.4 <removed>
@@ -89471,7 +89471,7 @@ CVE-2026-15342 (Plane contains a multi\u2011tenant authorization flaw in its ass
CVE-2026-15145 (The Essential Addons for Elementor \u2013 Popular Elementor Templates ...)
NOT-FOR-US: WordPress plugin
CVE-2026-12548 (A heap out-of-bounds read flaw was found in libsoup. When parsing mult ...)
- - libsoup3 <unfixed> (bug #1142838)
+ - libsoup3 3.8.0-1 (bug #1142838)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <postponed> (Minor issue, OOB read)
- libsoup2.4 <removed>
@@ -89481,7 +89481,7 @@ CVE-2026-12548 (A heap out-of-bounds read flaw was found in libsoup. When parsin
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/524
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/commit/7334c38f1f6aa5e64207cb415cf2509838c52b37 (3.7.1)
CVE-2026-12547 (SoupAuthManager caches proxy authentication credentials without scopin ...)
- - libsoup3 <unfixed> (bug #1142837)
+ - libsoup3 3.8.0-1 (bug #1142837)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <postponed> (Minor issue, credentials leak between trusted proxies)
- libsoup2.4 <removed>
@@ -97278,7 +97278,7 @@ CVE-2026-15720 (InOpen5GS through version 2.7.7 a pre-authenticationheap out-of-
CVE-2026-15715 (A vulnerability was identified in SourceCodester Class and Exam Timeta ...)
NOT-FOR-US: SourceCodester
CVE-2026-15714 (An out-of-bounds read vulnerability was found in libsoup's multipart p ...)
- - libsoup3 <unfixed> (bug #1142843)
+ - libsoup3 3.8.0-1 (bug #1142843)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <postponed> (Limited support)
- libsoup2.4 <removed>
@@ -97286,7 +97286,7 @@ CVE-2026-15714 (An out-of-bounds read vulnerability was found in libsoup's multi
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2499942
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/542
CVE-2026-15713 (A vulnerability was found in libsoup's HTTP/2 protocol implementation. ...)
- - libsoup3 <unfixed> (bug #1142842)
+ - libsoup3 3.8.0-1 (bug #1142842)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <postponed> (Limited support)
- libsoup2.4 <removed>
@@ -97296,14 +97296,14 @@ CVE-2026-15713 (A vulnerability was found in libsoup's HTTP/2 protocol implement
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/libsoup/-/commit/24fb645fa949ece7d7e10363b77cf2d5fa2c2469 (3.7.3)
TODO: While the above issue references this CVE, it doesn't match the CVE description at all, check with CNA (Red Hat)
CVE-2026-15712 (A heap buffer over-read vulnerability was discovered in libsoup's (ver ...)
- - libsoup3 <unfixed> (bug #1142841)
+ - libsoup3 3.8.0-1 (bug #1142841)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <postponed> (Limited support)
- libsoup2.4 <not-affected> (HTTP/2 support is libsoup3-only, libsoup 2.x has no HTTP/2 implementation)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2499939
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/540
CVE-2026-15711 (A vulnerability was found in libsoup's WebSocket frame parsing impleme ...)
- - libsoup3 <unfixed> (bug #1142840)
+ - libsoup3 3.8.0-1 (bug #1142840)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <postponed> (Limited support)
- libsoup2.4 <removed>
@@ -97311,7 +97311,7 @@ CVE-2026-15711 (A vulnerability was found in libsoup's WebSocket frame parsing i
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2499924
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/issues/515
CVE-2026-15709 (A flaw was found in libsoup's WebSocket implementation when using the ...)
- - libsoup3 <unfixed> (bug #1142839)
+ - libsoup3 3.8.0-1 (bug #1142839)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <postponed> (Limited support)
- libsoup2.4 <removed>
@@ -97421,7 +97421,7 @@ CVE-2026-12523 (Summary Cloudflare quiche's HTTP/3 layer was discovered to be
CVE-2026-12512 (The Quotes llama WordPress plugin before 3.1.6 does not properly sanit ...)
NOT-FOR-US: WordPress plugin
CVE-2026-12478 (The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the i ...)
- - libsoup3 <unfixed> (bug #1142836)
+ - libsoup3 3.8.0-1 (bug #1142836)
[trixie] - libsoup3 <not-affected> (Fix for CVE-2026-0716 not applied)
[bookworm] - libsoup3 <not-affected> (Fix for CVE-2026-0716 not applied)
- libsoup2.4 <not-affected> (Fix for CVE-2026-0716 not applied)
@@ -114965,7 +114965,7 @@ CVE-2026-12581 (EasyFlow .NET developed by Digiwin has a Session Fixation vulner
CVE-2026-12580 (EasyFlow .NET developed by Digiwin has a Stored Cross-Site Scripting v ...)
NOT-FOR-US: Digiwin
CVE-2026-12549 (The fix for CVE-2026-2443 was regressed by a subsequent rework commit ...)
- - libsoup3 <unfixed> (bug #1140924)
+ - libsoup3 3.8.0-1 (bug #1140924)
[trixie] - libsoup3 <not-affected> (Incomplete fix for CVE-2026-2443 not released)
[bookworm] - libsoup3 <not-affected> (Incomplete fix for CVE-2026-2443 not released)
- libsoup2.4 <removed>
@@ -131143,7 +131143,7 @@ CVE-2026-6891 (Improper handling of symbolic links in the installer of My Image
CVE-2026-6816 (An access bypass vulnerability in Drupal TFA Basic Plugins allows user ...)
NOT-FOR-US: Drupal core and addons
CVE-2026-6324 (A flaw was found in libsoup. A remote attacker could exploit an unsign ...)
- - libsoup3 <unfixed> (bug #1138213)
+ - libsoup3 3.8.0-1 (bug #1138213)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <no-dsa> (Minor issue)
- libsoup2.4 <removed>
@@ -169709,7 +169709,7 @@ CVE-2026-35545 (An issue was discovered in Roundcube Webmail before 1.5.15 and 1
NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/9d18d524f3cc211003fc99e2e54eed09a2f3da88 (1.6.15)
NOTE: Fixed by: https://github.com/roundcube/roundcubemail/commit/fe1320b199d3a2f58351bb699c9ed4316e73221b (1.5.15)
CVE-2026-5119 (A flaw was found in libsoup. When establishing HTTPS tunnels through a ...)
- - libsoup3 <unfixed> (bug #1132331)
+ - libsoup3 3.8.0-1 (bug #1132331)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <no-dsa> (Minor issue)
- libsoup2.4 <removed>
@@ -177462,7 +177462,7 @@ CVE-2026-4318 (A vulnerability was determined in UTT HiPER 810G up to 1.7.7-1711
CVE-2026-4295 (Improper trust boundary enforcement in Kiro IDE before version 0.8.0 o ...)
NOT-FOR-US: Amazon
CVE-2026-4271 (A flaw was found in libsoup, a library for handling HTTP requests. Thi ...)
- - libsoup3 <unfixed> (bug #1131447)
+ - libsoup3 3.8.0-1 (bug #1131447)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <no-dsa> (Minor issue)
- libsoup2.4 <removed>
@@ -179695,7 +179695,7 @@ CVE-2023-43010 (The issue was addressed with improved memory handling. This issu
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0001.html
CVE-2026-2436 (A flaw was found in libsoup's SoupServer. A remote attacker could expl ...)
- - libsoup3 <unfixed> (bug #1130498)
+ - libsoup3 3.8.0-1 (bug #1130498)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <no-dsa> (Minor issue)
- libsoup2.4 <removed>
@@ -181509,7 +181509,7 @@ CVE-2026-3632 (A flaw was found in libsoup, a library used by applications to se
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2445127
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/issues/483
CVE-2026-3633 (A flaw was found in libsoup. A remote attacker, by controlling the met ...)
- - libsoup3 <unfixed> (bug #1130500)
+ - libsoup3 3.8.0-1 (bug #1130500)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <no-dsa> (Minor issue)
- libsoup2.4 <removed>
@@ -181518,7 +181518,7 @@ CVE-2026-3633 (A flaw was found in libsoup. A remote attacker, by controlling th
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2445128
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/issues/484
CVE-2026-3634 (A flaw was found in libsoup. An attacker controlling the value used to ...)
- - libsoup3 <unfixed> (bug #1130501)
+ - libsoup3 3.8.0-1 (bug #1130501)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <no-dsa> (Minor issue)
- libsoup2.4 <removed>
@@ -186483,7 +186483,7 @@ CVE-2026-27624 (Coturn is a free open source implementation of TURN and STUN Ser
CVE-2026-3121 (A flaw was found in Keycloak. An administrator with `manage-clients` p ...)
- keycloak <itp> (bug #1088287)
CVE-2026-3099 (A flaw was found in Libsoup. The server-side digest authentication imp ...)
- - libsoup3 <unfixed> (bug #1129316)
+ - libsoup3 3.8.0-1 (bug #1129316)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <no-dsa> (Minor issue)
- libsoup2.4 <removed>
@@ -188917,7 +188917,7 @@ CVE-2025-13672 (Improper Neutralization of Input During Web Page Generation (XSS
CVE-2025-13671 (Cross-Site Request Forgery (CSRF) vulnerability in OpenText\u2122 Web ...)
NOT-FOR-US: OpenText
CVE-2026-2708 (A request smuggling vulnerability exists in libsoup's HTTP/1 header pa ...)
- - libsoup3 <unfixed> (bug #1128582)
+ - libsoup3 3.8.0-1 (bug #1128582)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <no-dsa> (Minor issue)
- libsoup2.4 <removed>
@@ -206017,7 +206017,7 @@ CVE-2026-21638 (A malicious actor in Wi-Fi range of the affected product could l
CVE-2026-0747 (Exposure of sensitive information in the TeamViewer entry dashboard co ...)
NOT-FOR-US: Devolutions
CVE-2026-0719 (A flaw was identified in the NTLM authentication handling of the libso ...)
- - libsoup3 <unfixed> (bug #1125083)
+ - libsoup3 3.8.0-1 (bug #1125083)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <no-dsa> (Minor issue)
- libsoup2.4 <removed>
@@ -302635,7 +302635,7 @@ CVE-2025-32050 (A flaw was found in libsoup. The libsoup append_param_quoted() f
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/issues/424
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/libsoup/-/commit/9bb0a55de55c6940ced811a64fbca82fe93a9323 (3.6.1)
CVE-2025-32049 (A flaw was found in libsoup. The SoupWebsocketConnection may accept a ...)
- - libsoup3 <unfixed> (bug #1102067)
+ - libsoup3 3.8.0-1 (bug #1102067)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <no-dsa> (Minor issue)
- libsoup2.4 <removed> (bug #1102211)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0012d83e49f4f21cfedb04dba82579f51e163427
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0012d83e49f4f21cfedb04dba82579f51e163427
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261001/bbe27168/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list