[Git][security-tracker-team/security-tracker][master] Add new libsoup issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
0069ad5c by Salvatore Bonaccorso at 2026-09-05T10:34:22+02:00
Add new libsoup issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -283,7 +283,10 @@ CVE-2026-85540 (DreamMaker developed by Interinfo has a SQL Injection vulnerabil
 CVE-2026-85538 (An incorrect authorization vulnerability in MISP allowed authenticated ...)
 	- misp <itp> (bug #1144317)
 CVE-2026-85534 (A flaw was found in libsoup. When a client sends an HTTP/2 request bod ...)
-	TODO: check
+	- libsoup3 <unfixed>
+	- libsoup2.4 <removed>
+	NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/551
+	NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/561
 CVE-2026-85533 (An authorization flaw in MISP allowed an authenticated user to submit  ...)
 	- misp <itp> (bug #1144317)
 CVE-2026-85528 (Improper input validation of the auto-configuration account identifier ...)
@@ -307,7 +310,9 @@ CVE-2026-85311 (Missing Authorization vulnerability in Kings Plugins MarketKing
 CVE-2026-85229 (** UNSUPPORTED WHEN ASSIGNED **Improper neutralization of input during ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-85197 (A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the ...)
-	TODO: check
+	- libsoup3 <unfixed>
+	- libsoup2.4 <removed>
+	NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/552
 CVE-2026-85184 (@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to r ...)
 	NOT-FOR-US: fastify/middie
 CVE-2026-85152 (undici 8.10.0 omits the destination origin from the cache and request- ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0069ad5cbb0cae7fa97f90912a6098f5fae05d06

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0069ad5cbb0cae7fa97f90912a6098f5fae05d06
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260905/d36ac9e7/attachment.htm>