An update for libsoup is now available for openEuler-24.03-LTS-SP3 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4040 Final 1.0 1.0 2026-09-25 Initial 2026-09-25 2026-09-25 openEuler SA Tool V1.0 2026-09-25 libsoup security update An update for libsoup is now available for openEuler-24.03-LTS-SP3 libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fix(es): A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via max_incoming_payload_size, it fails to track or limit memory allocation during decompression. A separate check for decompressed size (max_total_message_size) exists but executes only after inflation is complete, and it is entirely disabled by default for client connections. A remote, unauthenticated attacker can exploit this by sending a small, highly compressed payload (a decompression bomb), causing unbounded memory allocation that triggers an Out-of-Memory (OOM) crash and a Denial of Service (DoS).(CVE-2026-15709) A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated attacker acting as a malicious network peer can trick the connection engine into allocating stream states that are subsequently leaked during cleanup. Over a sustained period, this flaw allows the remote attacker to consume the system's heap allocations incrementally, triggering a denial of service (DoS) through an ultimate Out-of-Memory (OOM) application crash.(CVE-2026-15713) An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists in the soup_multipart_input_stream_read_headers() function inside soup-multipart-input-stream.c, which does not adequately restrict or validate the size of incoming multipart boundary strings. When processing a crafted HTTP response containing a malformed or oversized boundary parameter, the internal stream reader reads past the allocated buffer bounds. A remote, unauthenticated attacker can exploit this behavior to cause a service denial (DoS) through application failure or potentially read fragments of unauthorized memory metadata.(CVE-2026-15714) A vulnerability classified as problematic has been found in GNOME libsoup (affected version unknown). CWE is classifying the issue as CWE-93. The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. This is going to have an impact on integrity. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2026-3633) A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.(CVE-2026-66339) An update for libsoup is now available for openEuler-24.03-LTS-SP3. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High libsoup https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4040 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-15709 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-15713 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-15714 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-3633 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-66339 https://nvd.nist.gov/vuln/detail/CVE-2026-15709 https://nvd.nist.gov/vuln/detail/CVE-2026-15713 https://nvd.nist.gov/vuln/detail/CVE-2026-15714 https://nvd.nist.gov/vuln/detail/CVE-2026-3633 https://nvd.nist.gov/vuln/detail/CVE-2026-66339 openEuler-24.03-LTS-SP3 libsoup-2.74.3-27.oe2403sp3.aarch64.rpm libsoup-debuginfo-2.74.3-27.oe2403sp3.aarch64.rpm libsoup-debugsource-2.74.3-27.oe2403sp3.aarch64.rpm libsoup-devel-2.74.3-27.oe2403sp3.aarch64.rpm libsoup-2.74.3-27.oe2403sp3.src.rpm libsoup-2.74.3-27.oe2403sp3.x86_64.rpm libsoup-debuginfo-2.74.3-27.oe2403sp3.x86_64.rpm libsoup-debugsource-2.74.3-27.oe2403sp3.x86_64.rpm libsoup-devel-2.74.3-27.oe2403sp3.x86_64.rpm libsoup-help-2.74.3-27.oe2403sp3.noarch.rpm A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via max_incoming_payload_size, it fails to track or limit memory allocation during decompression. A separate check for decompressed size (max_total_message_size) exists but executes only after inflation is complete, and it is entirely disabled by default for client connections. A remote, unauthenticated attacker can exploit this by sending a small, highly compressed payload (a decompression bomb), causing unbounded memory allocation that triggers an Out-of-Memory (OOM) crash and a Denial of Service (DoS). 2026-09-25 CVE-2026-15709 openEuler-24.03-LTS-SP3 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H libsoup security update 2026-09-25 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4040 A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated attacker acting as a malicious network peer can trick the connection engine into allocating stream states that are subsequently leaked during cleanup. Over a sustained period, this flaw allows the remote attacker to consume the system's heap allocations incrementally, triggering a denial of service (DoS) through an ultimate Out-of-Memory (OOM) application crash. 2026-09-25 CVE-2026-15713 openEuler-24.03-LTS-SP3 Medium 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N libsoup security update 2026-09-25 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4040 An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists in the soup_multipart_input_stream_read_headers() function inside soup-multipart-input-stream.c, which does not adequately restrict or validate the size of incoming multipart boundary strings. When processing a crafted HTTP response containing a malformed or oversized boundary parameter, the internal stream reader reads past the allocated buffer bounds. A remote, unauthenticated attacker can exploit this behavior to cause a service denial (DoS) through application failure or potentially read fragments of unauthorized memory metadata. 2026-09-25 CVE-2026-15714 openEuler-24.03-LTS-SP3 Medium 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L libsoup security update 2026-09-25 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4040 A vulnerability classified as problematic has been found in GNOME libsoup (affected version unknown). CWE is classifying the issue as CWE-93. The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. This is going to have an impact on integrity. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product. 2026-09-25 CVE-2026-3633 openEuler-24.03-LTS-SP3 Low 3.9 AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L libsoup security update 2026-09-25 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4040 A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure. 2026-09-25 CVE-2026-66339 openEuler-24.03-LTS-SP3 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N libsoup security update 2026-09-25 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4040