Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
0012d83e by Salvatore Bonaccorso at 2026-10-01T08:18:42+02:00
Track fixes for libsoup3 via unstable
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -727,7 +727,7 @@ CVE-2026-103432 (apcupsd through 3.14.14 has an sscanf
stack-based buffer overfl
- apcupsd <unfixed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2493140
CVE-2026-103399 (A flaw was found in SoupServer (libsoup). When an HTTP/1.x
client send ...)
- - libsoup3 <unfixed>
+ - libsoup3 3.8.0-1
- libsoup2.4 <removed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543949
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/539
@@ -1838,7 +1838,7 @@ CVE-2026-102567 (CTranslate2 before 4.8.1 contains an
out-of-bounds heap read vu
CVE-2026-102566 (CTranslate2 before 4.8.1 contains a heap-based buffer
overflow in the ...)
NOT-FOR-US: CTranslate2
CVE-2026-102560 (A flaw was found in libsoup. When the permessage-deflate
WebSocket ext ...)
- - libsoup3 <unfixed>
+ - libsoup3 3.8.0-1
[trixie] - libsoup3 <no-dsa> (Minor issue)
- libsoup2.4 <removed>
[trixie] - libsoup2.4 <no-dsa> (Minor issue)
@@ -1846,7 +1846,7 @@ CVE-2026-102560 (A flaw was found in libsoup. When the
permessage-deflate WebSoc
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554
NOTE: Fixed by:
https://gitlab.gnome.org/GNOME/libsoup/-/commit/dbd0417ea3a569135e9a9344b7812076b7b178f1
(3.7.3)
CVE-2026-102559 (A flaw was found in libsoup. When constructing a masked
WebSocket clie ...)
- - libsoup3 <unfixed>
+ - libsoup3 3.8.0-1
[trixie] - libsoup3 <no-dsa> (Minor issue)
- libsoup2.4 <removed>
[trixie] - libsoup2.4 <no-dsa> (Minor issue)
@@ -1854,25 +1854,25 @@ CVE-2026-102559 (A flaw was found in libsoup. When
constructing a masked WebSock
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554
NOTE: Fixed by:
https://gitlab.gnome.org/GNOME/libsoup/-/commit/d7f074f8c8c90216f2476522836287c6f80fc53e
(3.7.3)
CVE-2026-102558 (A flaw was found in libsoup. When max-incoming-payload-size
is unlimit ...)
- - libsoup3 <unfixed>
+ - libsoup3 3.8.0-1
- libsoup2.4 <removed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543274
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554
NOTE: Fixed by:
https://gitlab.gnome.org/GNOME/libsoup/-/commit/381a474ff437d0f7573d2bb3e8d3027260ab584f
(3.7.3)
CVE-2026-102557 (A flaw was found in libsoup. When reassembling fragmented
WebSocket me ...)
- - libsoup3 <unfixed>
+ - libsoup3 3.8.0-1
- libsoup2.4 <removed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543231
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554
NOTE: Fixed by:
https://gitlab.gnome.org/GNOME/libsoup/-/commit/d7f074f8c8c90216f2476522836287c6f80fc53e
(3.7.3)
CVE-2026-102556 (A flaw was found in libsoup. When handling an incoming
WebSocket Pong ...)
- - libsoup3 <unfixed>
+ - libsoup3 3.8.0-1
- libsoup2.4 <removed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543229
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554
NOTE: Fixed by:
https://gitlab.gnome.org/GNOME/libsoup/-/commit/d2cbaf25f81a9ce041714cf842c366c67b0b873e
(3.7.3)
CVE-2026-102555 (A flaw was found in libsoup. The soup_uri_decode_data_uri()
function i ...)
- - libsoup3 <unfixed>
+ - libsoup3 3.8.0-1
- libsoup2.4 <removed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543224
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554
@@ -35241,7 +35241,7 @@ CVE-2026-85540 (DreamMaker developed by Interinfo has a
SQL Injection vulnerabil
CVE-2026-85538 (An incorrect authorization vulnerability in MISP allowed
authenticated ...)
- misp <itp> (bug #1144317)
CVE-2026-85534 (A flaw was found in libsoup. When a client sends an HTTP/2
request bod ...)
- - libsoup3 <unfixed> (bug #1146878)
+ - libsoup3 3.8.0-1 (bug #1146878)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <postponed> (Minor issue)
- libsoup2.4 <not-affected> (HTTP/2 support introduced in libsoup3)
@@ -35275,7 +35275,7 @@ CVE-2026-85311 (Missing Authorization vulnerability in
Kings Plugins MarketKing
CVE-2026-85229 (** UNSUPPORTED WHEN ASSIGNED **Improper neutralization of
input during ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85197 (A flaw was found in libsoup. A malicious HTTP/2 server or a
Man-in-the ...)
- - libsoup3 <unfixed> (bug #1146877)
+ - libsoup3 3.8.0-1 (bug #1146877)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <postponed> (Minor issue)
- libsoup2.4 <not-affected> (HTTP/2 support introduced in libsoup3)
@@ -47257,7 +47257,7 @@ CVE-2026-77694 (The Eventin WordPress plugin before
4.1.19 does not properly re
CVE-2026-77693 (The Order Tip for WooCommerce WordPress plugin before 1.6.0
does not c ...)
NOT-FOR-US: WordPress plugin
CVE-2026-77680 (An algorithmic complexity flaw exists in libsoup's HTTP Range
header p ...)
- - libsoup3 <unfixed> (bug #1145785)
+ - libsoup3 3.8.0-1 (bug #1145785)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <postponed> (Minor issue, DoS)
- libsoup2.4 <removed>
@@ -51364,7 +51364,7 @@ CVE-2026-77020 (A vulnerability was identified in
CodeAstro Apartment Visitor Ma
CVE-2026-77019 (A vulnerability was determined in CodeAstro Apartment Visitor
Manageme ...)
NOT-FOR-US: CodeAstro
CVE-2026-77014 (A flaw was found in libsoup's SoupServer HTTP Range header
processing. ...)
- - libsoup3 <unfixed> (bug #1144976)
+ - libsoup3 3.8.0-1 (bug #1144976)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <postponed> (Minor issue, DoS)
- libsoup2.4 <removed>
@@ -84334,7 +84334,7 @@ CVE-2026-66373 (Redis before 8.8.0, in the unusual case
where an authenticated a
NOTE: The same flaw in valkey is tracked in CVE-2026-63639, where
valkey was affected and
NOTE: fixed it in 9.1.1-1
CVE-2026-66339 (A flaw was found in libsoup. After a CONNECT tunnel is
established thr ...)
- - libsoup3 <unfixed> (bug #1142846)
+ - libsoup3 3.8.0-1 (bug #1142846)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <postponed> (Minor issue)
- libsoup2.4 <removed>
@@ -84343,7 +84343,7 @@ CVE-2026-66339 (A flaw was found in libsoup. After a
CONNECT tunnel is establish
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2506951
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/534
CVE-2026-66338 (A flaw was found in libsoup. The chunked transfer encoding
parser uses ...)
- - libsoup3 <unfixed> (bug #1142845)
+ - libsoup3 3.8.0-1 (bug #1142845)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <ignored> (Limited support, server unsupported)
- libsoup2.4 <removed>
@@ -84352,7 +84352,7 @@ CVE-2026-66338 (A flaw was found in libsoup. The
chunked transfer encoding parse
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2506950
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/533
CVE-2026-66337 (A flaw was found in libsoup. An unsigned integer underflow in
the soup ...)
- - libsoup3 <unfixed> (bug #1142844)
+ - libsoup3 3.8.0-1 (bug #1142844)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <postponed> (Minor issue)
- libsoup2.4 <removed>
@@ -89471,7 +89471,7 @@ CVE-2026-15342 (Plane contains a multi\u2011tenant
authorization flaw in its ass
CVE-2026-15145 (The Essential Addons for Elementor \u2013 Popular Elementor
Templates ...)
NOT-FOR-US: WordPress plugin
CVE-2026-12548 (A heap out-of-bounds read flaw was found in libsoup. When
parsing mult ...)
- - libsoup3 <unfixed> (bug #1142838)
+ - libsoup3 3.8.0-1 (bug #1142838)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <postponed> (Minor issue, OOB read)
- libsoup2.4 <removed>
@@ -89481,7 +89481,7 @@ CVE-2026-12548 (A heap out-of-bounds read flaw was
found in libsoup. When parsin
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/524
NOTE:
https://gitlab.gnome.org/GNOME/libsoup/-/commit/7334c38f1f6aa5e64207cb415cf2509838c52b37
(3.7.1)
CVE-2026-12547 (SoupAuthManager caches proxy authentication credentials
without scopin ...)
- - libsoup3 <unfixed> (bug #1142837)
+ - libsoup3 3.8.0-1 (bug #1142837)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <postponed> (Minor issue, credentials leak
between trusted proxies)
- libsoup2.4 <removed>
@@ -97278,7 +97278,7 @@ CVE-2026-15720 (InOpen5GS through version 2.7.7 a
pre-authenticationheap out-of-
CVE-2026-15715 (A vulnerability was identified in SourceCodester Class and
Exam Timeta ...)
NOT-FOR-US: SourceCodester
CVE-2026-15714 (An out-of-bounds read vulnerability was found in libsoup's
multipart p ...)
- - libsoup3 <unfixed> (bug #1142843)
+ - libsoup3 3.8.0-1 (bug #1142843)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <postponed> (Limited support)
- libsoup2.4 <removed>
@@ -97286,7 +97286,7 @@ CVE-2026-15714 (An out-of-bounds read vulnerability was
found in libsoup's multi
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2499942
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/542
CVE-2026-15713 (A vulnerability was found in libsoup's HTTP/2 protocol
implementation. ...)
- - libsoup3 <unfixed> (bug #1142842)
+ - libsoup3 3.8.0-1 (bug #1142842)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <postponed> (Limited support)
- libsoup2.4 <removed>
@@ -97296,14 +97296,14 @@ CVE-2026-15713 (A vulnerability was found in
libsoup's HTTP/2 protocol implement
NOTE: Fixed by:
https://gitlab.gnome.org/GNOME/libsoup/-/commit/24fb645fa949ece7d7e10363b77cf2d5fa2c2469
(3.7.3)
TODO: While the above issue references this CVE, it doesn't match the
CVE description at all, check with CNA (Red Hat)
CVE-2026-15712 (A heap buffer over-read vulnerability was discovered in
libsoup's (ver ...)
- - libsoup3 <unfixed> (bug #1142841)
+ - libsoup3 3.8.0-1 (bug #1142841)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <postponed> (Limited support)
- libsoup2.4 <not-affected> (HTTP/2 support is libsoup3-only, libsoup
2.x has no HTTP/2 implementation)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2499939
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/540
CVE-2026-15711 (A vulnerability was found in libsoup's WebSocket frame parsing
impleme ...)
- - libsoup3 <unfixed> (bug #1142840)
+ - libsoup3 3.8.0-1 (bug #1142840)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <postponed> (Limited support)
- libsoup2.4 <removed>
@@ -97311,7 +97311,7 @@ CVE-2026-15711 (A vulnerability was found in libsoup's
WebSocket frame parsing i
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2499924
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/issues/515
CVE-2026-15709 (A flaw was found in libsoup's WebSocket implementation when
using the ...)
- - libsoup3 <unfixed> (bug #1142839)
+ - libsoup3 3.8.0-1 (bug #1142839)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <postponed> (Limited support)
- libsoup2.4 <removed>
@@ -97421,7 +97421,7 @@ CVE-2026-12523 (Summary Cloudflare quiche's HTTP/3
layer was discovered to be
CVE-2026-12512 (The Quotes llama WordPress plugin before 3.1.6 does not
properly sanit ...)
NOT-FOR-US: WordPress plugin
CVE-2026-12478 (The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6)
placed the i ...)
- - libsoup3 <unfixed> (bug #1142836)
+ - libsoup3 3.8.0-1 (bug #1142836)
[trixie] - libsoup3 <not-affected> (Fix for CVE-2026-0716 not applied)
[bookworm] - libsoup3 <not-affected> (Fix for CVE-2026-0716 not applied)
- libsoup2.4 <not-affected> (Fix for CVE-2026-0716 not applied)
@@ -114965,7 +114965,7 @@ CVE-2026-12581 (EasyFlow .NET developed by Digiwin
has a Session Fixation vulner
CVE-2026-12580 (EasyFlow .NET developed by Digiwin has a Stored Cross-Site
Scripting v ...)
NOT-FOR-US: Digiwin
CVE-2026-12549 (The fix for CVE-2026-2443 was regressed by a subsequent rework
commit ...)
- - libsoup3 <unfixed> (bug #1140924)
+ - libsoup3 3.8.0-1 (bug #1140924)
[trixie] - libsoup3 <not-affected> (Incomplete fix for CVE-2026-2443
not released)
[bookworm] - libsoup3 <not-affected> (Incomplete fix for CVE-2026-2443
not released)
- libsoup2.4 <removed>
@@ -131143,7 +131143,7 @@ CVE-2026-6891 (Improper handling of symbolic links in
the installer of My Image
CVE-2026-6816 (An access bypass vulnerability in Drupal TFA Basic Plugins
allows user ...)
NOT-FOR-US: Drupal core and addons
CVE-2026-6324 (A flaw was found in libsoup. A remote attacker could exploit an
unsign ...)
- - libsoup3 <unfixed> (bug #1138213)
+ - libsoup3 3.8.0-1 (bug #1138213)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <no-dsa> (Minor issue)
- libsoup2.4 <removed>
@@ -169709,7 +169709,7 @@ CVE-2026-35545 (An issue was discovered in Roundcube
Webmail before 1.5.15 and 1
NOTE: Fixed by:
https://github.com/roundcube/roundcubemail/commit/9d18d524f3cc211003fc99e2e54eed09a2f3da88
(1.6.15)
NOTE: Fixed by:
https://github.com/roundcube/roundcubemail/commit/fe1320b199d3a2f58351bb699c9ed4316e73221b
(1.5.15)
CVE-2026-5119 (A flaw was found in libsoup. When establishing HTTPS tunnels
through a ...)
- - libsoup3 <unfixed> (bug #1132331)
+ - libsoup3 3.8.0-1 (bug #1132331)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <no-dsa> (Minor issue)
- libsoup2.4 <removed>
@@ -177462,7 +177462,7 @@ CVE-2026-4318 (A vulnerability was determined in UTT
HiPER 810G up to 1.7.7-1711
CVE-2026-4295 (Improper trust boundary enforcement in Kiro IDE before version
0.8.0 o ...)
NOT-FOR-US: Amazon
CVE-2026-4271 (A flaw was found in libsoup, a library for handling HTTP
requests. Thi ...)
- - libsoup3 <unfixed> (bug #1131447)
+ - libsoup3 3.8.0-1 (bug #1131447)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <no-dsa> (Minor issue)
- libsoup2.4 <removed>
@@ -179695,7 +179695,7 @@ CVE-2023-43010 (The issue was addressed with improved
memory handling. This issu
[bullseye] - wpewebkit <end-of-life> (see #1035997)
NOTE: https://webkitgtk.org/security/WSA-2026-0001.html
CVE-2026-2436 (A flaw was found in libsoup's SoupServer. A remote attacker
could expl ...)
- - libsoup3 <unfixed> (bug #1130498)
+ - libsoup3 3.8.0-1 (bug #1130498)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <no-dsa> (Minor issue)
- libsoup2.4 <removed>
@@ -181509,7 +181509,7 @@ CVE-2026-3632 (A flaw was found in libsoup, a library
used by applications to se
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2445127
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/issues/483
CVE-2026-3633 (A flaw was found in libsoup. A remote attacker, by controlling
the met ...)
- - libsoup3 <unfixed> (bug #1130500)
+ - libsoup3 3.8.0-1 (bug #1130500)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <no-dsa> (Minor issue)
- libsoup2.4 <removed>
@@ -181518,7 +181518,7 @@ CVE-2026-3633 (A flaw was found in libsoup. A remote
attacker, by controlling th
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2445128
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/issues/484
CVE-2026-3634 (A flaw was found in libsoup. An attacker controlling the value
used to ...)
- - libsoup3 <unfixed> (bug #1130501)
+ - libsoup3 3.8.0-1 (bug #1130501)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <no-dsa> (Minor issue)
- libsoup2.4 <removed>
@@ -186483,7 +186483,7 @@ CVE-2026-27624 (Coturn is a free open source
implementation of TURN and STUN Ser
CVE-2026-3121 (A flaw was found in Keycloak. An administrator with
`manage-clients` p ...)
- keycloak <itp> (bug #1088287)
CVE-2026-3099 (A flaw was found in Libsoup. The server-side digest
authentication imp ...)
- - libsoup3 <unfixed> (bug #1129316)
+ - libsoup3 3.8.0-1 (bug #1129316)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <no-dsa> (Minor issue)
- libsoup2.4 <removed>
@@ -188917,7 +188917,7 @@ CVE-2025-13672 (Improper Neutralization of Input
During Web Page Generation (XSS
CVE-2025-13671 (Cross-Site Request Forgery (CSRF) vulnerability in
OpenText\u2122 Web ...)
NOT-FOR-US: OpenText
CVE-2026-2708 (A request smuggling vulnerability exists in libsoup's HTTP/1
header pa ...)
- - libsoup3 <unfixed> (bug #1128582)
+ - libsoup3 3.8.0-1 (bug #1128582)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <no-dsa> (Minor issue)
- libsoup2.4 <removed>
@@ -206017,7 +206017,7 @@ CVE-2026-21638 (A malicious actor in Wi-Fi range of
the affected product could l
CVE-2026-0747 (Exposure of sensitive information in the TeamViewer entry
dashboard co ...)
NOT-FOR-US: Devolutions
CVE-2026-0719 (A flaw was identified in the NTLM authentication handling of
the libso ...)
- - libsoup3 <unfixed> (bug #1125083)
+ - libsoup3 3.8.0-1 (bug #1125083)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <no-dsa> (Minor issue)
- libsoup2.4 <removed>
@@ -302635,7 +302635,7 @@ CVE-2025-32050 (A flaw was found in libsoup. The
libsoup append_param_quoted() f
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/issues/424
NOTE: Fixed by:
https://gitlab.gnome.org/GNOME/libsoup/-/commit/9bb0a55de55c6940ced811a64fbca82fe93a9323
(3.6.1)
CVE-2025-32049 (A flaw was found in libsoup. The SoupWebsocketConnection may
accept a ...)
- - libsoup3 <unfixed> (bug #1102067)
+ - libsoup3 3.8.0-1 (bug #1102067)
[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <no-dsa> (Minor issue)
- libsoup2.4 <removed> (bug #1102211)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0012d83e49f4f21cfedb04dba82579f51e163427
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0012d83e49f4f21cfedb04dba82579f51e163427
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
