SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8975-1 advisory.

    It was discovered that libsoup incorrectly handled certain WebSocket frames. A remote attacker could     possibly use this issue to cause an application to crash or expose sensitive information. This issue only     affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-12478)

    It was discovered that libsoup incorrectly handled certain data URIs. A remote attacker could possibly use     this issue to cause an application to crash or expose sensitive information. This issue only affected     Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-102555)

    It was discovered that libsoup incorrectly handled certain WebSocket messages. A remote attacker could     possibly use this issue to cause an application to crash. This issue only affected Ubuntu 18.04 LTS,     Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10.
    (CVE-2026-102556)

    It was discovered that libsoup incorrectly handled fragmented WebSocket messages. A remote attacker could     possibly use this issue to cause an application to crash. (CVE-2026-102557)

    It was discovered that libsoup incorrectly handled certain WebSocket frames. A remote attacker could     possibly use this issue to cause an application to crash. This issue only affected Ubuntu 18.04 LTS,     Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10.
    (CVE-2026-102558)

    It was discovered that libsoup incorrectly handled large WebSocket messages. An attacker could possibly     use this issue to cause an application to crash. (CVE-2026-102559)

    It was discovered that libsoup incorrectly handled compressed WebSocket messages. An attacker could     possibly use this issue to cause an application to crash. This issue only affected Ubuntu 20.04 LTS,     Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-102560)

    It was discovered that libsoup did not properly handle certain HTTP requests. A remote attacker could     possibly use this issue to inject arbitrary HTTP requests. (CVE-2026-103399)

    It was discovered that libsoup incorrectly handled proxy credentials. A remote attacker could possibly use     this issue to obtain sensitive information. (CVE-2026-12547)

    It was discovered that libsoup incorrectly handled multipart messages. A remote attacker could possibly     use this issue to cause an application to crash or obtain sensitive information. (CVE-2026-12548)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority
    (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-
    Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.
    (CVE-2026-12547)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22181-1 advisory.

    - CVE-2026-12547: Header Proxy-Authorization leads to credentials being send to different proxy after     proxy switch       (bsc#1272195).
    - CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation (bsc#1272196).
    - CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame     protocol       violation (bsc#1271446).
    - CVE-2026-15712: SoupClientMessageIOHTTP2: HTTP/2 GOAWAY frame parsing heap buffer over-read via invalid     NUL-       termination assumption (bsc#1271447).
    - CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory     leak       (bsc#1271448).
    - CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in     soup_multipart_input_stream_read_headers       via an oversized multipart boundary string (bsc#1271449).
    - CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT     tunnels       (bsc#1273156).
    - CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding     (bsc#1283299).
    - CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).
    - CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).
    - CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).
    - CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).
    - CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).
    - CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request     smuggling       (bsc#1283831).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142299 advisory.

    SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority     (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-     Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4739-1 advisory.

    - CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after     proxy switch       (bsc#1272195).
    - CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame     protocol       violation (bsc#1271446).
    - CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory     leak       (bsc#1271448).
    - CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in     soup_multipart_input_stream_read_headers via       an oversized multipart boundary string (bsc#1271449).
    - CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT     tunnels       (bsc#1273156).
    - CVE-2026-77014: Integer truncation in sort_ranges() comparator causes silent omission of HTTP Range     responses       (bsc#1275988).
    - CVE-2026-77680: quadratic CPU denial of service in HTTP Range coalescing after the CVE-2025-32907 fix     (bsc#1276759).
    - CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).
    - CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).
    - CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).
    - CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).
    - CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).
    - CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request     smuggling       (bsc#1283831).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4690-1 advisory.

    - CVE-2026-12478: websocket: Fix out-of-bounds read when reading unmasked frame (bsc#1271401).
    - CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after     proxy switch       (bsc#1272195).
    - CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame     protocol       violation (bsc#1271446).
    - CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory     leak       (bsc#1271448).
    - CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in     soup_multipart_input_stream_read_headers via       an oversized multipart boundary string (bsc#1271449).
    - CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT     tunnels       (bsc#1273156).
    - CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).
    - CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).
    - CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).
    - CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).
    - CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request     smuggling       (bsc#1283831).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4703-1 advisory.

    - CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after     proxy switch       (bsc#1272195).
    - CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame     protocol       violation (bsc#1271446).
    - CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory     leak       (bsc#1271448).
    - CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in     soup_multipart_input_stream_read_headers via       an oversized multipart boundary string (bsc#1271449).
    - CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT     tunnels       (bsc#1273156).
    - CVE-2026-77014: Integer truncation in sort_ranges() comparator causes silent omission of HTTP Range     responses       (bsc#1275988).
    - CVE-2026-77680: quadratic CPU denial of service in HTTP Range coalescing after the CVE-2025-32907 fix     (bsc#1276759).
    - CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).
    - CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).
    - CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).
    - CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).
    - CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).
    - CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request     smuggling       (bsc#1283831).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3154 advisory.

    The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if     (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can     send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-     based client when max_incoming_payload_size is set to 0. (CVE-2026-12478)

    SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority     (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-     Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.
    (CVE-2026-12547)

    A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type     mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly     truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an     application using libsoup or potentially disclose heap memory contents. (CVE-2026-12548)

    The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow     checks with a general signed comparison. When a client sends a Range request with a suffix length     exceeding the content size, the resulting negative start value is not properly clamped, leading to     malformed HTTP 206 responses and log flooding. (CVE-2026-12549)

    A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup     incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel     to the destination server. This allows the destination server to capture proxy credentials, leading to     information disclosure. (CVE-2026-66339)

    A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in     soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range     offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206     Partial Content responses on resources larger than approximately 2 GB. (CVE-2026-77014)

    An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the     CVE-2025-32907 fix.

    CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single     Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in     libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using     g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal     performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0     repeated thousands of times), the loop performs O(N2) work coalescing them into a single range.

    The vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-     server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No     authentication is required. The number of ranges is bounded only by the maximum request header size (~100     KiB), allowing roughly 25,000 ranges per request. Reporter measurements on libsoup HEAD containing the     CVE-2025-32907 fix show ~90 ms single-core CPU per such request at the wire maximum, blocking the server's     event loop for that duration.

    This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs.

    Affected: libsoup versions containing the CVE-2025-32907 fix but not merge request !550.Fixed upstream: MR     !550 merged 2026-08-20, replacing per-element removal with O(N) in-place compaction and rejecting Range     headers requesting more than 200 ranges.Upstream report:
    https://gitlab.gnome.org/GNOME/libsoup/-/issues/538Related: CVE-2025-32907 (CVE-2026-77680)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libsoup installed on the remote host is prior to 2.56.0-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3970 advisory.

    OOB Read via Integer Overflow on libsoup through libsoup/websocket/soup-websocket-connection.c via     process_frame() leads to Undefined Behavior (CVE-2026-0716)

    The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if     (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can     send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-     based client when max_incoming_payload_size is set to 0. (CVE-2026-12478)

    SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority     (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-     Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.
    (CVE-2026-12547)

    A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type     mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly     truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an     application using libsoup or potentially disclose heap memory contents. (CVE-2026-12548)

    The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow     checks with a general signed comparison. When a client sends a Range request with a suffix length     exceeding the content size, the resulting negative start value is not properly clamped, leading to     malformed HTTP 206 responses and log flooding. (CVE-2026-12549)

    A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until()     function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can     exploit this by sending a crafted multipart response, potentially causing the client application to crash     or disclose sensitive heap memory. (CVE-2026-66337)

    A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for     chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign     prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this     parsing differential can be exploited to smuggle HTTP requests. (CVE-2026-66338)

    A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup     incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel     to the destination server. This allows the destination server to capture proxy credentials, leading to     information disclosure. (CVE-2026-66339)

    A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in     soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range     offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206     Partial Content responses on resources larger than approximately 2 GB. (CVE-2026-77014)

    An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the     CVE-2025-32907 fix.

    CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single     Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in     libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using     g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal     performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0     repeated thousands of times), the loop performs O(N2) work coalescing them into a single range.

    The vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-     server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No     authentication is required. The number of ranges is bounded only by the maximum request header size (~100     KiB), allowing roughly 25,000 ranges per request. Reporter measurements on libsoup HEAD containing the     CVE-2025-32907 fix show ~90 ms single-core CPU per such request at the wire maximum, blocking the server's     event loop for that duration.

    This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs.

    Affected: libsoup versions containing the CVE-2025-32907 fix but not merge request !550.Fixed upstream: MR     !550 merged 2026-08-20, replacing per-element removal with O(N) in-place compaction and rejecting Range     headers requesting more than 200 ranges.Upstream report:
    https://gitlab.gnome.org/GNOME/libsoup/-/issues/538Related: CVE-2025-32907 (CVE-2026-77680)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4558-1 advisory.

    - CVE-2026-12478: websocket: Fix out-of-bounds read when reading unmasked frame (bsc#1271401).
    - CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after     proxy switch       (bsc#1272195).
    - CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame     protocol       violation (bsc#1271446).
    - CVE-2026-15712: SoupClientMessageIOHTTP2: HTTP/2 GOAWAY frame parsing heap buffer over-read via invalid     NUL-       termination assumption (bsc#1271447).
    - CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in     soup_multipart_input_stream_read_headers via       an oversized multipart boundary string (bsc#1271449).
    - CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT     tunnels       (bsc#1273156).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4557-1 advisory.

    - CVE-2026-12478: websocket: Fix out-of-bounds read when reading unmasked frame (bsc#1271401).
    - CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after     proxy switch       (bsc#1272195).
    - CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame     protocol       violation (bsc#1271446).
    - CVE-2026-15712: SoupClientMessageIOHTTP2: HTTP/2 GOAWAY frame parsing heap buffer over-read via invalid     NUL-       termination assumption (bsc#1271447).
    - CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in     soup_multipart_input_stream_read_headers via       an oversized multipart boundary string (bsc#1271449).
    - CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT     tunnels       (bsc#1273156).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3144 advisory.

    The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if     (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can     send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-     based client when max_incoming_payload_size is set to 0. (CVE-2026-12478)

    SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority     (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-     Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.
    (CVE-2026-12547)

    A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type     mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly     truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an     application using libsoup or potentially disclose heap memory contents. (CVE-2026-12548)

    The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow     checks with a general signed comparison. When a client sends a Range request with a suffix length     exceeding the content size, the resulting negative start value is not properly clamped, leading to     malformed HTTP 206 responses and log flooding. (CVE-2026-12549)

    A heap buffer over-read vulnerability was discovered in libsoup's HTTP/2 connection tracking framework.
    When the library processes an HTTP/2 GOAWAY frame, it improperly handles the Additional Debug Data     payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict     length-boundary verification before reading this data, a remote, unauthenticated attacker can     intentionally send a malformed GOAWAY frame missing the appropriate null delimiter. This causes the     library to read past the end of the allocated buffer, triggering an application crash that results in a     denial of service (DoS), or potentially exposing fragments of memory contents. (CVE-2026-15712)

    A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly     release memory context blocks under specific stream termination conditions, such as when an HTTP/2     connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated attacker     acting as a malicious network peer can trick the connection engine into allocating stream states that are     subsequently leaked during cleanup. Over a sustained period, this flaw allows the remote attacker to     consume the system's heap allocations incrementally, triggering a denial of service (DoS) through an     ultimate Out-of-Memory (OOM) application crash. (CVE-2026-15713)

    An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists     in the soup_multipart_input_stream_read_headers() function inside soup-multipart-input-stream.c, which     does not adequately restrict or validate the size of incoming multipart boundary strings. When processing     a crafted HTTP response containing a malformed or oversized boundary parameter, the internal stream reader     reads past the allocated buffer bounds. A remote, unauthenticated attacker can exploit this behavior to     cause a service denial (DoS) through application failure or potentially read fragments of unauthorized     memory metadata. (CVE-2026-15714)

    A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup     incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel     to the destination server. This allows the destination server to capture proxy credentials, leading to     information disclosure. (CVE-2026-66339)

    A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in     soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range     offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206     Partial Content responses on resources larger than approximately 2 GB. (CVE-2026-77014)

    An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the     CVE-2025-32907 fix.

    CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single     Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in     libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using     g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal     performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0     repeated thousands of times), the loop performs O(N2) work coalescing them into a single range.

    The vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-     server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No     authentication is required. The number of ranges is bounded only by the maximum request header size (~100     KiB), allowing roughly 25,000 ranges per request. Reporter measurements on libsoup HEAD containing the     CVE-2025-32907 fix show ~90 ms single-core CPU per such request at the wire maximum, blocking the server's     event loop for that duration.

    This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs.

    Affected: libsoup versions containing the CVE-2025-32907 fix but not merge request !550.Fixed upstream: MR     !550 merged 2026-08-20, replacing per-element removal with O(N) in-place compaction and rejecting Range     headers requesting more than 200 ranges.Upstream report:
    https://gitlab.gnome.org/GNOME/libsoup/-/issues/538Related: CVE-2025-32907 (CVE-2026-77680)

    A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit     a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME     application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file body is being     read asynchronously. This can lead to memory corruption, potentially resulting in information disclosure     or arbitrary code execution. (CVE-2026-85197)

    A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream,     the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2     server can shrink SETTINGS_INITIAL_WINDOW_SIZE while that buffered read is still in progress. The client     then copies the full buffer into a smaller DATA callback without a runtime bounds check, which can abort     the process or fail the HTTP/2 session. (CVE-2026-85534)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority     (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-     Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.
    (CVE-2026-12547)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
375783	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : libsoup vulnerabilities (USN-8975-1)	Nessus	Ubuntu Local Security Checks	Local	critical
478250	Echo: libsoup3: security update to 3.8.0-1	Tenable Cloud Security	Echo Local Security Checks	Local	low
478250	Echo: libsoup3: security update to 3.8.0-1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
374749	openSUSE 16 Security Update : libsoup (openSUSE-SU-2026:22181-1)	Nessus	SuSE Local Security Checks	Local	critical
370126	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libsoup (UTSA-2026-142299)	Nessus	Unity Linux Local Security Checks	Local	low
367745	SUSE SLES15: libsoup-2_4-1 / libsoup2-devel / libsoup2-lang / etc (SUSE-SU-2026:4739-1)	Nessus	SuSE Local Security Checks	Local	critical
366750	SUSE SLES12: libsoup-2_4-1 / libsoup-2_4-1-32bit / libsoup-devel / libsoup-lang / etc (SUSE-SU-2026:4690-1)	Nessus	SuSE Local Security Checks	Local	high
366743	SUSE SLED15: libsoup-2_4-1 / libsoup2-devel / libsoup2-lang / etc (SUSE-SU-2026:4703-1)	Nessus	SuSE Local Security Checks	Local	critical
365254	Amazon Linux 2023 : libsoup, libsoup-devel (ALAS2023-2026-3154)	Nessus	Amazon Linux Local Security Checks	Local	medium
365200	Amazon Linux 2 : libsoup (ALAS-2026-3970)	Nessus	Amazon Linux Local Security Checks	Local	high
364125	SUSE SLED15 / SLES15 Security Update : libsoup (SUSE-SU-2026:4558-1)	Nessus	SuSE Local Security Checks	Local	medium
364122	SUSE SLES15 Security Update : libsoup (SUSE-SU-2026:4557-1)	Nessus	SuSE Local Security Checks	Local	medium
351071	Amazon Linux 2023 : libsoup3, libsoup3-devel (ALAS2023-2026-3144)	Nessus	Amazon Linux Local Security Checks	Local	high
329709	Linux Distros Unpatched Vulnerability : CVE-2026-12547	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-12547

low

Tenable Plugins

critical

low

low

critical

low

critical

high

critical

medium

high

medium

medium

high

low