# CVE-2026-77680: Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix

> Attackers can cause CPU exhaustion in libsoup servers by sending crafted HTTP Range headers, leading to denial of service.

- **Severity:** Medium 5.3 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 25 Aug 2026
- **Updated:** 26 Aug 2026
- **Also known as:** DEBIAN-CVE-2026-77680, ECHO-c5f5-4a30-a822, GHSA-9m98-w4qj-8f6q, UBUNTU-CVE-2026-77680

## What is CVE-2026-77680?

CVE-2026-77680 is a medium-severity denial of service vulnerability in Red Hat Enterprise Linux 10, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix.

CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N²) work coalescing them into a single range.

The vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required. The number of ranges is bounded only by the maximum request header size (~100 KiB), allowing roughly 25,000 ranges per request. Reporter measurements on libsoup HEAD containing the CVE-2025-32907 fix show ~90 ms single-core CPU per such request at the wire maximum, blocking the server's event loop for that duration.

This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs.

Affected: libsoup versions containing the CVE-2025-32907 fix but not merge request !550.
Fixed upstream: MR !550 merged 2026-08-20, replacing per-element removal with O(N) in-place compaction and rejecting Range headers requesting more than 200 ranges.
Upstream report: https://gitlab.gnome.org/GNOME/libsoup/-/issues/538
Related: CVE-2025-32907

Weakness: CWE-407 (Inefficient Algorithmic Complexity)

## Which versions are affected by CVE-2026-77680?


## How do I fix CVE-2026-77680?

Apply the vendor's patch.

## Is CVE-2026-77680 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-77680 exists.

Public exploit code:

- Cybersecurity research and vulnerability analysis (github_poc): https://github.com/OJ01-creates/CVE-2026-77680-Security-Analysis

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-77680 and fix it if it is affected.

What it is: CVE-2026-77680 is a medium-severity denial of service vulnerability in Red Hat Enterprise Linux 10, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-77680 exists.

Affected product: Red Hat Enterprise Linux 10. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-77680/ (Markdown: https://insights.sbomify.com/CVE-2026-77680/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-77680
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-77680
- OSV: https://osv.dev/vulnerability/CVE-2026-77680

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-77680/
Summaries are generated and may contain mistakes; the official description above is the record.