libsoup3_3.6.5-8_source.changes ACCEPTED into unstable

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 03 Feb 2026 16:42:19 -0500
Source: libsoup3
Built-For-Profiles: noudeb
Architecture: source
Version: 3.6.5-8
Distribution: unstable
Urgency: high
Maintainer: Debian GNOME Maintainers <pkg-gnome-maintainers at lists.alioth.debian.org>
Changed-By: Jeremy Bícha <jbicha at ubuntu.com>
Closes: 1126548 1126627 1126628 1126876 1126877
Changes:
 libsoup3 (3.6.5-8) unstable; urgency=high
 .
   [ Bruce Cable ]
   * SECURITY UPDATE: Carriage Return Line Feed Injection
     - debian/patches/CVE-2026-1467.patch: Do host validation when checking if
       a GUri is valid
       - CVE-2026-1467 (Closes: #1126548)
     - debian/patches/CVE-2026-1536.patch: Always validate the headers value
       when coming from untrusted source
       - CVE-2026-1536 (Closes: #1126627)
   * SECURITY UPDATE: Information Leak
     - debian/patches/CVE-2026-1539.patch: Also remove Proxy-Authorization
       header on cross origin redirect
     - CVE-2026-1539 (Closes: #1126628)
 .
   [ Jeremy Bícha ]
   * SECURITY UPDATE: HTTP Request smuggling vulnerability
     - debian/patches/CVE-2026-1760.patch: Close the connection after
       responding to a request containing Content-Length and Transfer-Encoding
       - CVE-2026-1760 (Closes: #1126876)
   * SECURITY UPDATE: Stack-based buffer overflow vulnerability
     - debian/patches/CVE-2026-1761.patch: Make sure read length is smaller
       than buffer length when boundary is found
       - CVE-2026-1761 (Closes: #1126877)
   * SECURITY UPDATE: HTTP Request smuggling vulnerability
     - debian/patches/CVE-2026-1801-pre1.patch: Correct chunked trailers
        end detection
     - debian/patches/CVE-2026-1801.patch: Use CRLF as line boundary
       when parsing chunked encoding data
       - CVE-2026-1801
Checksums-Sha1:
 c16b69f40bb9e4a53079c99395cfdf9cfcf3d424 2957 libsoup3_3.6.5-8.dsc
 18dba61d2e09139b18e5108922f89386d68b5917 56460 libsoup3_3.6.5-8.debian.tar.xz
 d9e620abedc6547d43698e51e6bea038dcd2b3df 13405 libsoup3_3.6.5-8_source.buildinfo
Checksums-Sha256:
 0f3f5e7a68a3bcd4c680dc6b5ef715e8e9e935df435b7b0c39fbd2b57503e105 2957 libsoup3_3.6.5-8.dsc
 4d3d9488ca90dd75f6fce1003d6139d8f54a76c8ea39a2642200e7bf195f6299 56460 libsoup3_3.6.5-8.debian.tar.xz
 113bf93cf1f30f485b1ea3afb91860b8a6b6bcefa8c89964a5a55877c051512a 13405 libsoup3_3.6.5-8_source.buildinfo
Files:
 698a7cb387570744a87f7a5b0d6c8ba1 2957 devel optional libsoup3_3.6.5-8.dsc
 539863e83b083171d659a6b5771074b2 56460 devel optional libsoup3_3.6.5-8.debian.tar.xz
 bc486a607d360aa33fc8112cb038c5d7 13405 devel optional libsoup3_3.6.5-8_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEETQvhLw5HdtiqzpaW5mx3Wuv+bH0FAmmCa/oACgkQ5mx3Wuv+
bH1YchAAy2e/+y2+EhJRfiQH6mwNXtqhQEZNvshtMwLRh3gsPWtQfoMw2rVyWe+Y
RZiSbhKwy1yORdiDoJqmY/3c8HsstBPTfL1ls7OVSeqpraJokHnNS5Xe3USC4v7s
lS3OH3t1gtXVQkL/CtLGLDK4gRI8qw5Vc90LaDkrE7zz/rMvOI60m9XKrfqdJbNQ
UEgUIKOykzFhP+Klox40bb4ojTOdhqO3qUekBMoFIQy7PbU8R8w4OucgUeiG3Oqg
mmxwj9t/cfYH+cH5dViPSJlGeBLUPeA/bbzBDIDOPKHn0LWc2Ra2efWkzmJEiG2y
BuMf+a8JDcKpTz+nazezyYE745297KyoAjnhKBRT4g+O51j/EWDINUBS36vKTfse
1pvQrMODOaIlaWAYNy1K0OAPQBZ6a8z05gEtT1Hnw4+VqMwIeCoW+9MMnTYKKY5J
/IWiUi+pdwswCPvxKDuyVBq2LE56ICzlxsCMepWZAoW/WHOjL7a4MnozehvriCnr
oiKtPvVxdr5uqsd4/soRjsg/V2Qq5wrg0FLhQZbBQI2MBbkTCpz37MSNbh4oSxdQ
vdzBE1nedX+CCAIVy0ikZceNfOWtsRnbgVBKC5vQs48GoayFui/jL9TVAtgLZzFv
VeEZkPNiWuERCsVJINcDDDgbah794HjxqsiVj1TKDor/QMpIRm8=
=VaQD
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-gnome-maintainers/attachments/20260203/44d2abfb/attachment.sig>