This update for libsoup fixes the following issues:
- CVE-2026-12547: Header "Proxy-Authorization" leads to credentials being send to different proxy after proxy switch
(bsc#1272195).
- CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation (bsc#1272196).
- CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol
violation (bsc#1271446).
- CVE-2026-15712: SoupClientMessageIOHTTP2: HTTP/2 GOAWAY frame parsing heap buffer over-read via invalid NUL-
termination assumption (bsc#1271447).
- CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaus
This update for libsoup fixes the following issues:
- CVE-2026-85197: heap use-after-free in HTTP/2 `client on_data_read()` via `GOAWAY` during body upload (bsc#1279238).
- CVE-2026-85534: heap buffer overflow in `SoupSession` through `on_data_source_read_callback()` via `SETTINGS` frame
with crafted `INITIAL_WINDOW_SIZE` (bsc#1279239).
This update for libsoup fixes the following issues
- CVE-2026-0716: out-of-bounds read when processing a crafted unmasked frame with a payload length near `UINT64_MAX`
sent by a WebSocket server (bsc#1256418).
This update for libsoup fixes the following issues:
Update to libsoup 3.6.6:
- CVE-2025-12105: heap use-after-free in message queue handling during HTTP/2 read completion (bsc#1252555).
- CVE-2025-14523: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (bsc#1254876).
- CVE-2025-32049: Denial of Service attack to websocket server (bsc#1240751).
- CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests (bsc#1257398).
- CVE-2026-1539: proxy authentication credentials leaked via the Proxy-Authorization header when handling HTTP redirects
(bsc#1257441).
- CVE-2026-1760: improper handling of
This update for libsoup fixes the following issues:
- CVE-2026-1536: HTTP header injection or response splitting via CRLF injection in the Content-Disposition header
(bsc#1257440).
- CVE-2026-1761: incorrect length calculation when parsing of multipart HTTP responses can lead to a stack-based
buffer overflow (bsc#1257598).
This update for libsoup fixes the following issues:
- CVE-2025-11021: Fixed out-of-bounds read in Cookie Date Handling of libsoup HTTP Library (bsc#1250562).
- CVE-2026-0719: Fixed stack-based buffer overflow in NTLM authentication can lead to arbitrary code execution (bsc#1256399).
- CVE-2026-0716: Fixed improper bounds handling may allow out-of-bounds read (bsc#1256418).