{"answers":{"affected":"","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-77680 exists.","fix":"Apply the vendor's patch.","what":"CVE-2026-77680 is a medium-severity denial of service vulnerability in Red Hat Enterprise Linux 10, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-77680 and fix it if it is affected.\n\nWhat it is: CVE-2026-77680 is a medium-severity denial of service vulnerability in Red Hat Enterprise Linux 10, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-77680 exists.\n\nAffected product: Red Hat Enterprise Linux 10. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-77680/ (Markdown: https://insights.sbomify.com/CVE-2026-77680/index.md)","id":"CVE-2026-77680","markdown":"https://insights.sbomify.com/CVE-2026-77680/index.md","name":"CVE-2026-77680","record":{"aliases":["DEBIAN-CVE-2026-77680","ECHO-c5f5-4a30-a822","GHSA-9m98-w4qj-8f6q","UBUNTU-CVE-2026-77680"],"analysis":{"component_type":"library","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"HTTP client/server library","requires_auth":"none","summary":"Attackers can cause CPU exhaustion in libsoup servers by sending crafted HTTP Range headers, leading to denial of service.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"redhat","cpe":[],"cvss":{"score":5.3,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"cwes":[{"id":"CWE-407","name":"Inefficient Algorithmic Complexity"}],"description":"An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix.\n\nCVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N²) work coalescing them into a single range.\n\nThe vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required. The number of ranges is bounded only by the maximum request header size (~100 KiB), allowing roughly 25,000 ranges per request. Reporter measurements on libsoup HEAD containing the CVE-2025-32907 fix show ~90 ms single-core CPU per such request at the wire maximum, blocking the server's event loop for that duration.\n\nThis is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs.\n\nAffected: libsoup versions containing the CVE-2025-32907 fix but not merge request !550.\nFixed upstream: MR !550 merged 2026-08-20, replacing per-element removal with O(N) in-place compaction and rejecting Range headers requesting more than 200 ranges.\nUpstream report: https://gitlab.gnome.org/GNOME/libsoup/-/issues/538\nRelated: CVE-2025-32907","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":"2026-10-21","github_poc":1,"max_poc_stars":0,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-10-21T06:03:02Z","kind":"github_poc","ref":"https://github.com/OJ01-creates/CVE-2026-77680-Security-Analysis","stars":0,"title":"Cybersecurity research and vulnerability analysis"}],"tier":"weaponised"},"has_fix":true,"headline":"Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix","id":"CVE-2026-77680","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"CodeAstro Online Job Portal update-profile.php unrestricted upload","id":"CVE-2026-77681"},"packages":[],"prev":{"headline":"Dia: dia: stack buffer overflow in bus object via unvalidated handle count in project files","id":"CVE-2026-77658"},"products":["Red Hat Enterprise Linux 10"],"published":"2026-08-25","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-26","vendors":["Red Hat"]},"summary":"Attackers can cause CPU exhaustion in libsoup servers by sending crafted HTTP Range headers, leading to denial of service.","url":"https://insights.sbomify.com/CVE-2026-77680/"}