SUSE-SU-2026:0657-1
SUSE-SU-2026:0657-1 · Security update for libsoup2
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This update for libsoup2 fixes the following issues: - CVE-2025-32049: denial of Service attack to websocket server (bsc#1240751). - CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120). - CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170). - CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).
Fix available
- Published
- Updated
Stack: system
Affected products and versions
libsoup2 SUSE:Linux Enterprise Module for Basesystem 15 SP7
- Affected ranges
- ECOSYSTEM: < 2.74.3-150600.4.27.1
Update to 2.74.3-150600.4.27.1
libsoup2 SUSE:Linux Enterprise Server 15 SP6-LTSS
- Affected ranges
- ECOSYSTEM: < 2.74.3-150600.4.27.1
Update to 2.74.3-150600.4.27.1
libsoup2 SUSE:Linux Enterprise Server for SAP Applications 15 SP6
- Affected ranges
- ECOSYSTEM: < 2.74.3-150600.4.27.1
Update to 2.74.3-150600.4.27.1
libsoup2 openSUSE:Leap 15.6
- Affected ranges
- ECOSYSTEM: < 2.74.3-150600.4.27.1
Update to 2.74.3-150600.4.27.1
Original sources
- https://www.suse.com/support/update/announcement/2026/suse-su-20260657-1/
- https://bugzilla.suse.com/1240751
- https://bugzilla.suse.com/1258120
- https://bugzilla.suse.com/1258170
- https://bugzilla.suse.com/1258508
- https://www.suse.com/security/cve/CVE-2025-32049
- https://www.suse.com/security/cve/CVE-2026-2369
- https://www.suse.com/security/cve/CVE-2026-2443
- https://www.suse.com/security/cve/CVE-2026-2708
- https://osv.dev/vulnerability/SUSE-SU-2026:0657-1