Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-77680— Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix

Quick assessment

Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是对该漏洞描述信息的中文翻译： libsoup 的 HTTP Range 头处理中存在一个算法复杂度缺陷，该缺陷在 CVE-2025-32907 修复后依然存续。 CVE-2025-32907 解决了当客户端在单个 Range 头中重复指定同一范围多次时导致的内存放大问题。提交 修正了 中 的合并正确性问题，但合并循环仍对每个合并后的元素使用 来移除已合并的范围。由于 是连续内存结构，每次移除数组中间的元素都会执行 O(N) 复杂度的内存移动（memmove）。当提供大量相同的可满足范围（例如， 重复数千次）时

CVSS 5.3 · Medium

Possible ATT&CK Techniques 1 AI

T1496 · Resource Hijacking
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77680

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix
Source: CVE Program / CVE List V5
Vulnerability Description
An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N²) work coalescing them into a single range. The vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required. The number of ranges is bounded only by the maximum request header size (~100 KiB), allowing roughly 25,000 ranges per request. Reporter measurements on libsoup HEAD containing the CVE-2025-32907 fix show ~90 ms single-core CPU per such request at the wire maximum, blocking the server's event loop for that duration. This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs. Affected: libsoup versions containing the CVE-2025-32907 fix but not merge request !550. Fixed upstream: MR !550 merged 2026-08-20, replacing per-element removal with O(N) in-place compaction and rejecting Range headers requesting more than 200 ranges. Upstream report: https://gitlab.gnome.org/GNOME/libsoup/-/issues/538 Related: CVE-2025-32907
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Enterprise Linux 10 - cpe:/o:redhat:enterprise_linux:10

II. Public POCs for CVE-2026-77680

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-77680

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-77680 (2)

Other References for CVE-2026-77680 (1)

Same Patch Batch · Red Hat · 2026-08-25 · 10 CVEs total

CVE-2026-79992 7.8 HIGH Emacs: local shell command injection through the user field in emacs tramp
CVE-2026-79655 7.8 HIGH Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targ
CVE-2026-80186 7.6 HIGH Bluez: stack overflow in name2utf8 causes dos and potential code execution
CVE-2026-78701 6.5 MEDIUM 389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall d
CVE-2026-78322 6.5 MEDIUM File-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and rar hand
CVE-2026-79717 6.4 MEDIUM Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restrict
CVE-2026-79652 5.9 MEDIUM Keycloak-services: keycloak-services: jwt bearer authorization grant does not enforce cons
CVE-2026-80185 5.7 MEDIUM Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary cod
CVE-2026-80101 4.4 MEDIUM Gimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-l

IV. Related Vulnerabilities

Same product: Red Hat Enterprise Linux 10
Same vendor: Red Hat
Same weakness: CWE-407

V. Comments for CVE-2026-77680

No comments yet

Leave a comment