CVE-2026-77014 Libsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responses
Integer truncation in libsoup causes silent omission of HTTP range responses for large files, leading to incomplete data delivery.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-77014?
CVE-2026-77014 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.
Weakness: CWE-197
Which versions are affected by CVE-2026-77014?
How do I fix CVE-2026-77014?
Apply the vendor's patch.
Is CVE-2026-77014 being exploited?
There is no known exploitation of CVE-2026-77014 in the wild and no public exploit code.
Sources
Also known as AZL-97482, DEBIAN-CVE-2026-77014, ECHO-2595-990f-e6ce, GHSA-wmpg-2mpv-2hmm, UBUNTU-CVE-2026-77014.