Your message dated Thu, 01 Oct 2026 05:49:25 +0000
with message-id <[email protected]>
and subject line Bug#1130501: fixed in libsoup3 3.8.0-1
has caused the Debian Bug report #1130501,
regarding libsoup3: CVE-2026-3634
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1130501: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1130501
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: libsoup3
Version: 3.6.6-1
Severity: important
Tags: security upstream
Forwarded: https://gitlab.gnome.org/GNOME/libsoup/-/issues/485
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for libsoup3.
CVE-2026-3634[0]:
| libsoup: CRLF injection in soup_message_headers_set_content_type()
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-3634
https://www.cve.org/CVERecord?id=CVE-2026-3634
[1] https://gitlab.gnome.org/GNOME/libsoup/-/issues/485
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: libsoup3
Source-Version: 3.8.0-1
Done: Jeremy Bícha <[email protected]>
We believe that the bug you reported is fixed in the latest version of
libsoup3, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Jeremy Bícha <[email protected]> (supplier of updated libsoup3 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 01 Oct 2026 07:27:21 +0200
Source: libsoup3
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 3.8.0-1
Distribution: unstable
Urgency: high
Maintainer: Debian GNOME Maintainers
<[email protected]>
Changed-By: Jeremy Bícha <[email protected]>
Closes: 1102067 1125083 1128582 1129316 1130498 1130500 1130501 1131447 1132331
1138213 1140924 1142836 1142837 1142838 1142839 1142840 1142841 1142842 1142843
1142844 1142845 1142846 1144976 1145785 1146877 1146878
Launchpad-Bugs-Fixed: 2169104
Changes:
libsoup3 (3.8.0-1) unstable; urgency=high
.
* New upstream release (LP: #2169104)
- SECURITY UPDATE:
- CVE-2025-32049 (Closes: #1102067)
- CVE-2026-0719 (Closes: #1125083)
- CVE-2026-1536 (Closes: #1130501)
- CVE-2026-2436 (Closes: #1130498)
- CVE-2026-2708 (Closes: #1128582)
- CVE-2026-3099 (Closes: #1129316)
- CVE-2026-3633 (Closes: #1130500)
- CVE-2026-3634 (Closes: #1130501)
- CVE-2026-4271 (Closes: #1131447)
- CVE-2026-5119 (Closes: #1132331)
- CVE-2026-6324 (Closes: #1138213)
- CVE-2026-12478 (Closes: #1142836)
- CVE-2026-12547 (Closes: #1142837)
- CVE-2026-12548 (Closes: #1142838)
- CVE-2026-12549 (Closes: #1140924)
- CVE-2026-15709 (Closes: #1142839)
- CVE-2026-15711 (Closes: #1142840)
- CVE-2026-15712 (Closes: #1142841)
- CVE-2026-15713 (Closes: #1142842)
- CVE-2026-15714 (Closes: #1142843)
- CVE-2026-66337 (Closes: #1142844)
- CVE-2026-66338 (Closes: #1142845)
- CVE-2026-66339 (Closes: #1142846)
- CVE-2026-77014 (Closes: #1144976)
- CVE-2026-77680 (Closes: #1145785)
- CVE-2026-85197 (Closes: #1146877)
- CVE-2026-85534 (Closes: #1146878)
- CVE-2026-102555
- CVE-2026-102556
- CVE-2026-102557
- CVE-2026-102558
- CVE-2026-102559
- CVE-2026-102560
- CVE-2026-103399
* libsoup-3.0-0.symbols: Add new symbols
* Add Build-Depends: libzstd-dev
* Add patch to revert build test change that doesn't work for 32-bit
architectures
* Remove one security patch applied in new release
* Build with debhelper compat 14
* Run wrap-and-sort -ast
* Update debian/upstream/metadata
* Update Standards Version to 4.7.4
Checksums-Sha1:
1c299050b87395934378356c25114e09ebb978d1 2982 libsoup3_3.8.0-1.dsc
d5b88a826b98e0bfe3f74435b0e9d6500a3951b7 1609676 libsoup3_3.8.0.orig.tar.xz
e453b767b0a8f5ef0ba94747e357a5ab7ff3b099 31196 libsoup3_3.8.0-1.debian.tar.xz
2ddb5b043eb285c83c4680cff9c98f7d0ae25a74 13336
libsoup3_3.8.0-1_source.buildinfo
Checksums-Sha256:
ec527da7e94913df677ba66c1692e733d2fad0e84214f93608a379470b6ddf7f 2982
libsoup3_3.8.0-1.dsc
bbf08fa3e03a88c31a3d27a0d87cb422e9490f2d08e149211103df6d638a2238 1609676
libsoup3_3.8.0.orig.tar.xz
a5a14b5c78ddbf77c36e6b34c300f3e671b3241d32ae253f1132927a8b59d043 31196
libsoup3_3.8.0-1.debian.tar.xz
42e4d73348017b12426e7f56a620909685e5e7a095da07057bc2d0665b43866c 13336
libsoup3_3.8.0-1_source.buildinfo
Files:
5577463c458f849da8c2ecca700512fb 2982 devel optional libsoup3_3.8.0-1.dsc
3e7e404362998102b602698c799a0759 1609676 devel optional
libsoup3_3.8.0.orig.tar.xz
c2c1604f59c544c45ee2cbb3f3506caa 31196 devel optional
libsoup3_3.8.0-1.debian.tar.xz
43a27af70845ed920469c50864ff3caf 13336 devel optional
libsoup3_3.8.0-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEETQvhLw5HdtiqzpaW5mx3Wuv+bH0FAmq97+MACgkQ5mx3Wuv+
bH3qdw//Y6fS/wc52jK+l/eLKtJMJMT5sjVKZMauLOLRc4YvY2VSMJpbhoNkcAU+
3vIF07X8c+1Fa2LqB/HKeaqvAwHFJufx3fgrk89Wt/5WvJrlobReYUJ3KZGfdSil
xpXs8SRe8Fhol+SS7aON14V7pk9sgd/e46mUKucurGdLPxoKTksVwoO31+nB/toQ
U0NmCPomdcmfeB2QGwvOaSbvjUhbKee3Mvv3gLsaPCuzy5D1VOFB9WXh4KzlfIyf
3Fd05oCvYgAU+e8AgPunnochTfTxaOtdbQ8gXjwp1LvZES1zitKuSY7dCoVkGUtQ
p8Se/IBozAGsEQvYypERCpOWh57rtwf4Yrk5AbsmsZo9Sjl42D0OJ0a+ln83nWhG
4NgQ5AnbBop7I7TrlxFZBbDPrWP4TafZNOemqv5YUlN6vud2hpLuHv1V2B0rEU1H
FZGXtOu2DkR2sK2sXlb00WB4NqwChIyrRjL1j8eGvDDFYLtOwCxRM/h/jGvVpVxl
LAiZkj1z7TNwu/BTevBnAC5r9u8xO8R7OmFAcPw28L+CzP50tDEYss19mLnRKUs6
1uV9xMEqxrg1ykHrUHrD56PJx+/OqFb9jrAg6Ab3kzY1z0QybZ20Wq0OZULmsReO
XFidASnb11zRLIpF8TBaqM9iDXLTgSBT4aykUAlsx/a8U6vZqC4=
=SD8B
-----END PGP SIGNATURE-----
pgpgoqEnF6KTq.pgp
Description: PGP signature
--- End Message ---
