libsoup Integer Truncation Causes Silent Omission of HTTP Range Responses (CVE-2026-77014)

Vulnerability Overview Vulnerability ID: Bug 2520143 (CVE-2026-77014) Vulnerability Type: libsoup: Integer truncation in sort_ranges() comparator causes silent omission of HTTP Range responses Report Date: 2026-08-20 07:44 UTC by OSIDB Bzimport Modified Date: 2026-08-20 08:06 UTC Status: NEW Aliases: CVE-2026-77014 Product: Security Response Component: vulnerability Version: unspecified Hardware: All OS: Linux Priority: medium Severity: medium Target Milestone: --- Assignee: Product Security QA Contact: --- Doc Contact: --- URL: --- Whiteboard: --- Depends On: 2520148, 2520149, 2520150 Blocks: --- TreeView: depends on / blocked Impact Scope Environment: --- Fixed Version: --- Closed: --- Archived: --- CC List: 4 users (zhw) Remediation Fixed Version: --- Closed Reason: --- Archived Reason: --- Vulnerability Description Description: A vulnerability was discovered in the SoupServer HTTP Range header handling in libsoup. The comparator function in returns the difference between two (64-bit) values as an (32-bit). When the starting positions of two ranges in a multi-range request differ by more than (~2.1 billion), the truncation flips the sign of the comparison result, violating the sorting order required by . Unsorted ranges are incorrectly merged, causing the server to silently omit the requested byte ranges. An unauthenticated remote attacker can trigger this vulnerability by sending a multi-range Range request for a resource larger than approximately 2 GB, with range start offsets exceeding . The client receives fewer ranges than requested without any error indication, compromising data integrity for resumable downloads, delta updates, mirror synchronization, and large object chunk verification. POC Code Attachment: OSIDB Bzimport - 2026-08-20 07:44:57 UTC Description: No specific code block provided; only the vulnerability impact and trigger conditions are described. Additional Information Notes: Login required to comment on or modify this vulnerability. --- Summary: This vulnerability involves an integer truncation issue in libsoup, potentially leading to the silent omission of HTTP Range responses and affecting data integrity. No specific remediation or POC code has been provided yet.

Goal Reached Thanks to every supporter — we hit 100%!

libsoup Integer Truncation Causes Silent Omission of HTTP Range Responses (CVE-2026-77014)