[Git][security-tracker-team/security-tracker][master] Add new libsoup3 issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
28ed0065 by Salvatore Bonaccorso at 2026-09-30T07:46:13+02:00
Add new libsoup3 issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -452,17 +452,41 @@ CVE-2026-102567 (CTranslate2 before 4.8.1 contains an out-of-bounds heap read vu
 CVE-2026-102566 (CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the  ...)
 	NOT-FOR-US: CTranslate2
 CVE-2026-102560 (A flaw was found in libsoup. When the permessage-deflate WebSocket ext ...)
-	TODO: check
+	- libsoup3 <unfixed>
+	- libsoup2.4 <removed>
+	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543296
+	NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554
+	NOTE: Fixed by: https://gitlab.gnome.org/GNOME/libsoup/-/commit/dbd0417ea3a569135e9a9344b7812076b7b178f1 (3.7.3)
 CVE-2026-102559 (A flaw was found in libsoup. When constructing a masked WebSocket clie ...)
-	TODO: check
+	- libsoup3 <unfixed>
+	- libsoup2.4 <removed>
+	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543285
+	NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554
+	NOTE: Fixed by: https://gitlab.gnome.org/GNOME/libsoup/-/commit/d7f074f8c8c90216f2476522836287c6f80fc53e (3.7.3)
 CVE-2026-102558 (A flaw was found in libsoup. When max-incoming-payload-size is unlimit ...)
-	TODO: check
+	- libsoup3 <unfixed>
+	- libsoup2.4 <removed>
+	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543274
+	NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554
+	NOTE: Fixed by: https://gitlab.gnome.org/GNOME/libsoup/-/commit/381a474ff437d0f7573d2bb3e8d3027260ab584f (3.7.3)
 CVE-2026-102557 (A flaw was found in libsoup. When reassembling fragmented WebSocket me ...)
-	TODO: check
+	- libsoup3 <unfixed>
+	- libsoup2.4 <removed>
+	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543231
+	NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554
+	NOTE: Fixed by: https://gitlab.gnome.org/GNOME/libsoup/-/commit/d7f074f8c8c90216f2476522836287c6f80fc53e (3.7.3)
 CVE-2026-102556 (A flaw was found in libsoup. When handling an incoming WebSocket Pong  ...)
-	TODO: check
+	- libsoup3 <unfixed>
+	- libsoup2.4 <removed>
+	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543229
+	NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554
+	NOTE: Fixed by: https://gitlab.gnome.org/GNOME/libsoup/-/commit/d2cbaf25f81a9ce041714cf842c366c67b0b873e (3.7.3)
 CVE-2026-102555 (A flaw was found in libsoup. The soup_uri_decode_data_uri() function i ...)
-	TODO: check
+	- libsoup3 <unfixed>
+	- libsoup2.4 <removed>
+	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543224
+	NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554
+	NOTE: Fixed by: https://gitlab.gnome.org/GNOME/libsoup/-/commit/e4f032268fa18f691a6c34d6adcb5b666f3e3f77 (3.7.3)
 CVE-2026-102521 (The decoder in `readFromDataView` in lib0 before 0.2.119 can be tricke ...)
 	NOT-FOR-US: lib0
 CVE-2026-102507 (Sliver C2 framework version 1.7.7 and earlier contains an unhandled pa ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/28ed0065480a47d3e28a7c21a40a99251e5579a6

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/28ed0065480a47d3e28a7c21a40a99251e5579a6
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260930/33fa07da/attachment-0001.htm>