CVE-2026-6324
Publication date 29 May 2026
Last updated 6 June 2026
Ubuntu priority
Description
A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the `soup_body_input_stream_read_chunked()` function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| libsoup2.4 | 26.04 LTS resolute |
Needs evaluation
|
| 25.10 questing |
Needs evaluation
|
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| libsoup3 | 26.04 LTS resolute |
Needs evaluation
|
| 25.10 questing |
Needs evaluation
|
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Needs evaluation
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
4.8 · Medium
|
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | Low |
| Integrity impact | Low |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
References
Other references
- https://www.cve.org/CVERecord?id=CVE-2026-6324
- https://gitlab.gnome.org/GNOME/libsoup/-/issues/508
- https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/517
- https://gitlab.gnome.org/GNOME/libsoup/-/commit/96ac392b444d01bd5de1d1276b187c3ed49d048c (3.7.1)
- https://access.redhat.com/security/cve/CVE-2026-6324
- https://bugzilla.redhat.com/show_bug.cgi?id=2458479