CVE-2026-77014
Fixed in a distro release EPSS <1%CVSS 5.3
A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.
Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | libsoup | 2.56.0-6.amzn2.0.9 |
| Amazon Linux 2 | libsoup-devel | 2.56.0-6.amzn2.0.9 |
| Amazon Linux 2023 | libsoup | 2.72.0-6.amzn2023.0.15 |
| Amazon Linux 2023 | libsoup-devel | 2.72.0-6.amzn2023.0.15 |
| Amazon Linux 2023 | libsoup-doc | 2.72.0-6.amzn2023.0.15 |
| Amazon Linux 2023 | libsoup3 | 3.7.2-1.amzn2023 |
| Amazon Linux 2023 | libsoup3-devel | 3.7.2-1.amzn2023 |
| Amazon Linux 2023 | libsoup3-doc | 3.7.2-1.amzn2023 |
| Debian 12 | libsoup2.4 | no fix |
| Debian 12 | libsoup3 | no fix |
| Debian 13 | libsoup2.4 | no fix |
| Debian 13 | libsoup3 | no fix |
| Debian 14 | libsoup3 | 3.8.0-1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | libsoup2 | 2.74.3-150400.3.43.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | libsoup2 | 2.74.3-150400.3.43.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | libsoup2 | 2.74.3-150400.3.43.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | libsoup2 | 2.74.3-150400.3.43.1 |
| SUSE Linux Enterprise Micro 5.3 | libsoup2 | 2.74.3-150400.3.43.1 |
| SUSE Linux Enterprise Micro 5.4 | libsoup2 | 2.74.3-150400.3.43.1 |
| SUSE Linux Enterprise Micro 5.5 | libsoup2 | 2.74.3-150400.3.43.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | libsoup2 | 2.74.3-150600.4.42.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | libsoup2 | 2.74.3-150400.3.43.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | libsoup2 | 2.74.3-150400.3.43.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | libsoup2 | 2.74.3-150600.4.42.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | libsoup2 | 2.74.3-150400.3.43.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | libsoup2 | 2.74.3-150400.3.43.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | libsoup2 | 2.74.3-150600.4.42.1 |
| Ubuntu 22.04 LTS | libsoup2.4 | 2.74.2-3ubuntu0.9 |
| Ubuntu 24.04 LTS | libsoup2.4 | 2.74.3-6ubuntu1.9 |
| Ubuntu 24.04 LTS | libsoup3 | 3.4.4-5ubuntu0.9 |
| Ubuntu 26.04 LTS | libsoup3 | 3.6.6-1ubuntu0.1 |
| Ubuntu 26.10 | libsoup2.4 | no fix |
| Ubuntu 26.10 | libsoup3 | 3.6.6-1ubuntu3 |
| Ubuntu Pro 16.04 LTS | libsoup2.4 | 2.52.2-1ubuntu0.3+esm8 |
| Ubuntu Pro 18.04 LTS | libsoup2.4 | 2.62.1-1ubuntu0.4+esm9 |
| Ubuntu Pro 20.04 LTS | libsoup2.4 | 2.70.0-1ubuntu0.5+esm4 |
| Ubuntu Pro 22.04 LTS | libsoup3 | 3.0.7-0ubuntu1+esm9 |
| Ubuntu Pro 26.04 LTS | libsoup2.4 | 2.74.3-10.1ubuntu5+esm3 |
| openSUSE Tumbleweed | libsoup2 | 2.74.3-23.1 |