CVE-2026-1761 Libsoup: stack-based buffer overflow in libsoup multipart response parsingmultipart http response
Remote attackers can trigger a stack-based buffer overflow in libsoup via crafted multipart responses, leading to code execution or crashes in applications processing untrusted data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-1761?
CVE-2026-1761 is a high-severity memory corruption vulnerability in Red Hat Enterprise Linux 10, published on 2 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by sending a specially crafted multipart HTTP response, which can lead to memory corruption. This issue may result in application crashes or arbitrary code execution in applications that process untrusted server responses, and it does not require authentication or user interaction.
Weakness: CWE-121
Which versions are affected by CVE-2026-1761?
Linux distribution packages (10)
libsoup3-doc AlmaLinux:10 | All versions | 3.6.5-3.el10_1.10 |
libsoup3 Red Hat:enterprise_linux:10.1 | All versions | 0:3.6.5-3.el10_1.10 |
libsoup3-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:3.6.5-3.el10_1.10 |
libsoup3-debugsource Red Hat:enterprise_linux:10.1 | All versions | 0:3.6.5-3.el10_1.10 |
libsoup3-devel Red Hat:enterprise_linux:10.1 | All versions | 0:3.6.5-3.el10_1.10 |
libsoup3-doc Red Hat:enterprise_linux:10.1 | All versions | 0:3.6.5-3.el10_1.10 |
libsoup3 Rocky Linux:10 | All versions | 0:3.6.5-3.el10_1.10 |
libsoup SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 2.62.2-5.29.1 |
libsoup SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 2.62.2-5.29.1 |
libsoup2 openSUSE:Leap 16.0 | All versions | 2.74.3-160000.3.1 |
How do I fix CVE-2026-1761?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-1761 being exploited?
There is no known exploitation of CVE-2026-1761 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:2410, AZL-76697, AZL-76740, DEBIAN-CVE-2026-1761, ECHO-74b5-8029-1a64, GHSA-6j8r-j98h-9g9f and 7 more.