Debian Linux - libsoup2.4 - None

libsoup3 - None

Red Hat Enterprise Linux - libsoup: libsoup: Buffer overread due to integer underflow when handling zero-length resources

Ubuntu Linux - [Unknown description]

amazon_alas ALAS2023-2026-1460: Amazon Linux 2023 Security Advisory:ALAS2023-2026-1460

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0703-1 advisory.

    - CVE-2026-0716: improper bounds handling may allow out-of-bounds read (bsc#1256418).
    - CVE-2025-4476: null pointer dereference may lead to denial of service (bsc#1243422).
    - CVE-2025-32049: denial of Service attack to websocket server (bsc#1240751).
    - CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources     (bsc#1258120).
    - CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap     information       disclosure to remote attackers (bsc#1258170).
    - CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0657-1 advisory.

    - CVE-2025-32049: denial of Service attack to websocket server (bsc#1240751).
    - CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources     (bsc#1258120).
    - CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap     information       disclosure to remote attackers (bsc#1258170).
    - CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0690-1 advisory.

    - CVE-2025-32049: denial of Service attack to websocket server (bsc#1240751).
    - CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources     (bsc#1258120).
    - CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap     information       disclosure to remote attackers (bsc#1258170).
    - CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0689-1 advisory.

    - CVE-2025-32049: denial of Service attack to websocket server (bsc#1240751).
    - CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources     (bsc#1258120).
    - CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap     information       disclosure to remote attackers (bsc#1258170).
    - CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The vulnerability exists due to an integer underflow in libsoup when processing zero-length resources,     which leads to a buffer overread that could allow an attacker to access sensitive information or cause an     application-level denial of service. (CVE-2026-2369)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
300651	SUSE SLES12 Security Update : libsoup (SUSE-SU-2026:0703-1)	Nessus	SuSE Local Security Checks	medium
300582	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libsoup2 (SUSE-SU-2026:0657-1)	Nessus	SuSE Local Security Checks	high
300249	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libsoup (SUSE-SU-2026:0690-1)	Nessus	SuSE Local Security Checks	high
300248	SUSE SLES15 Security Update : libsoup (SUSE-SU-2026:0689-1)	Nessus	SuSE Local Security Checks	high
298801	Linux Distros Unpatched Vulnerability : CVE-2026-2369	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-2369

medium

Tenable Plugins

Coming Soon

medium

high

high

high

critical