An update for libsoup3 is now available for openEuler-24.03-LTS-SP3 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3695 Final 1.0 1.0 2026-09-05 Initial 2026-09-05 2026-09-05 openEuler SA Tool V1.0 2026-09-05 libsoup3 security update An update for libsoup3 is now available for openEuler-24.03-LTS-SP3 Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. Security Fix(es): A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.(CVE-2026-12548) The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding.(CVE-2026-12549) A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or less. A remote, unauthenticated attacker can exploit this by sending a non-compliant, oversized control frame. Because the parser handles this protocol violation improperly instead of throwing an immediate connection termination error, it triggers a internal processing crash, resulting in a remote denial of service (DoS) for applications utilizing libsoup WebSockets.(CVE-2026-15711) A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.(CVE-2026-77014) An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N²) work coalescing them into a single range. The vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required. The number of ranges is bounded only by the maximum request header size (~100 KiB), allowing roughly 25,000 ranges per request. This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs.(CVE-2026-77680) An update for libsoup3 is now available for openEuler-24.03-LTS-SP3. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High libsoup3 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3695 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-12548 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-12549 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-15711 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-77014 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-77680 https://nvd.nist.gov/vuln/detail/CVE-2026-12548 https://nvd.nist.gov/vuln/detail/CVE-2026-12549 https://nvd.nist.gov/vuln/detail/CVE-2026-15711 https://nvd.nist.gov/vuln/detail/CVE-2026-77014 https://nvd.nist.gov/vuln/detail/CVE-2026-77680 openEuler-24.03-LTS-SP3 libsoup3-3.4.5-24.oe2403sp3.aarch64.rpm libsoup3-debuginfo-3.4.5-24.oe2403sp3.aarch64.rpm libsoup3-debugsource-3.4.5-24.oe2403sp3.aarch64.rpm libsoup3-devel-3.4.5-24.oe2403sp3.aarch64.rpm libsoup3-3.4.5-24.oe2403sp3.src.rpm libsoup3-3.4.5-24.oe2403sp3.x86_64.rpm libsoup3-debuginfo-3.4.5-24.oe2403sp3.x86_64.rpm libsoup3-debugsource-3.4.5-24.oe2403sp3.x86_64.rpm libsoup3-devel-3.4.5-24.oe2403sp3.x86_64.rpm libsoup3-help-3.4.5-24.oe2403sp3.noarch.rpm A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents. 2026-09-05 CVE-2026-12548 openEuler-24.03-LTS-SP3 Medium 4.2 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L libsoup3 security update 2026-09-05 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3695 The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding. 2026-09-05 CVE-2026-12549 openEuler-24.03-LTS-SP3 Medium 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L libsoup3 security update 2026-09-05 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3695 A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or less. A remote, unauthenticated attacker can exploit this by sending a non-compliant, oversized control frame. Because the parser handles this protocol violation improperly instead of throwing an immediate connection termination error, it triggers a internal processing crash, resulting in a remote denial of service (DoS) for applications utilizing libsoup WebSockets. 2026-09-05 CVE-2026-15711 openEuler-24.03-LTS-SP3 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H libsoup3 security update 2026-09-05 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3695 A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB. 2026-09-05 CVE-2026-77014 openEuler-24.03-LTS-SP3 Medium 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N libsoup3 security update 2026-09-05 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3695 An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N²) work coalescing them into a single range. The vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required. The number of ranges is bounded only by the maximum request header size (~100 KiB), allowing roughly 25,000 ranges per request. This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs. 2026-09-05 CVE-2026-77680 openEuler-24.03-LTS-SP3 Medium 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L libsoup3 security update 2026-09-05 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3695