CVE-2026-2443 Libsoup: out-of-bounds read in libsoup handle_partial_get() leading to heap information disclosure

What is CVE-2026-2443?

CVE-2026-2443 is a medium-severity vulnerability in Redhat Enterprise Linux, published on 13 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access portions of server memory beyond the intended response. Exploitation requires a vulnerable configuration and access to a server using the embedded SoupServer component.

Weakness: CWE-125

Which versions are affected by CVE-2026-2443?

It affects 2 products.

Products include Gnome Libsoup, Redhat Enterprise Linux.

How do I fix CVE-2026-2443?

Apply the vendor's patch.

Is CVE-2026-2443 being exploited?

There is no known exploitation of CVE-2026-2443 in the wild and no public exploit code.

Other vulnerabilities in Redhat Enterprise Linux

• CVE-2026-102556 Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion High 8.6
• CVE-2026-102557 Libsoup: libsoup: heap buffer overflow during websocket message reassembly High 8.6
• CVE-2026-102558 Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth High 8.6
• CVE-2026-102559 Libsoup: libsoup: heap buffer overflow during websocket client-frame masking High 8.6
• CVE-2026-102560 Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth High 8.6

All Redhat Enterprise Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-77889, AZL-77894, DEBIAN-CVE-2026-2443, ECHO-1ae6-5677-99cd, GHSA-hg24-p7xv-jhq8, OESA-2026-1684 and 1 more.