Detections
Analytics

Echo: libsoup3: security update to 3.6.6-1+e6

medium Tenable Self-Hosted Container Security Plugin ID 461019

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the
 CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range
 many times in a single Range header. Commit 9bb92f7a corrected merge correctness in
 soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers.c, but the coalescing loop
 still removes merged ranges using g_array_remove_index() for each coalesced element. Because GArray is
 contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are
 supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N²) work coalescing them
 into a single range. The vulnerable path is reachable server-side from handle_partial_get() in
 libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-
 empty body. No authentication is required. The number of ranges is bounded only by the maximum request
 header size (~100 KiB), allowing roughly 25,000 ranges per request. Reporter measurements on libsoup HEAD
 containing the CVE-2025-32907 fix show ~90 ms single-core CPU per such request at the wire maximum,
 blocking the server's event loop for that duration. This is a CPU exhaustion / availability issue only. No
 memory corruption or information disclosure occurs. Affected: libsoup versions containing the
 CVE-2025-32907 fix but not merge request !550. Fixed upstream: MR !550 merged 2026-08-20, replacing per-
 element removal with O(N) in-place compaction and rejecting Range headers requesting more than 200 ranges.
 Upstream report: https://gitlab.gnome.org/GNOME/libsoup/-/issues/538 Related: CVE-2025-32907
 (CVE-2026-77680)

Solution

Update the libsoup3 library and its related packages to version 3.6.6-1+e6 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-77680

Plugin Details

Severity: Medium

ID: 461019

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2026-77680

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/26/2026

Vulnerability Publication Date: 8/25/2026

Reference Information

CVE: CVE-2026-77680