| Bug | bookworm | trixie | forky | sid | Description |
|---|
| CVE-2026-103399 | vulnerable (no DSA, ignored) | vulnerable (no DSA) | vulnerable | fixed | A flaw was found in SoupServer (libsoup). When an HTTP/1.x client send ... |
| CVE-2026-102560 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable | fixed | A flaw was found in libsoup. When the permessage-deflate WebSocket ext ... |
| CVE-2026-102559 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable | fixed | A flaw was found in libsoup. When constructing a masked WebSocket clie ... |
| CVE-2026-102558 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable | fixed | A flaw was found in libsoup. When max-incoming-payload-size is unlimit ... |
| CVE-2026-102557 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable | fixed | A flaw was found in libsoup. When reassembling fragmented WebSocket me ... |
| CVE-2026-102556 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable | fixed | A flaw was found in libsoup. When handling an incoming WebSocket Pong ... |
| CVE-2026-102555 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable | fixed | A flaw was found in libsoup. The soup_uri_decode_data_uri() function i ... |
| CVE-2026-85534 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable | fixed | A flaw was found in libsoup. When a client sends an HTTP/2 request bod ... |
| CVE-2026-85197 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable | fixed | A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the ... |
| CVE-2026-77680 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable | fixed | An algorithmic complexity flaw exists in libsoup's HTTP Range header p ... |
| CVE-2026-77014 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable | fixed | A flaw was found in libsoup's SoupServer HTTP Range header processing. ... |
| CVE-2026-66339 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable | fixed | A flaw was found in libsoup. After a CONNECT tunnel is established thr ... |
| CVE-2026-66338 | vulnerable (no DSA, ignored) | vulnerable (no DSA) | vulnerable | fixed | A flaw was found in libsoup. The chunked transfer encoding parser uses ... |
| CVE-2026-66337 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable | fixed | A flaw was found in libsoup. An unsigned integer underflow in the soup ... |
| CVE-2026-15714 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable | fixed | An out-of-bounds read vulnerability was found in libsoup's multipart p ... |
| CVE-2026-15713 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable | fixed | A vulnerability was found in libsoup's HTTP/2 protocol implementation. ... |
| CVE-2026-15712 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable | fixed | A heap buffer over-read vulnerability was discovered in libsoup's (ver ... |
| CVE-2026-15711 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable | fixed | A vulnerability was found in libsoup's WebSocket frame parsing impleme ... |
| CVE-2026-15709 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable | fixed | A flaw was found in libsoup's WebSocket implementation when using the ... |
| CVE-2026-12549 | fixed | fixed | vulnerable | fixed | The fix for CVE-2026-2443 was regressed by a subsequent rework commit ... |
| CVE-2026-12548 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable | fixed | A heap out-of-bounds read flaw was found in libsoup. When parsing mult ... |
| CVE-2026-12547 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable | fixed | SoupAuthManager caches proxy authentication credentials without scopin ... |
| CVE-2026-12478 | fixed | fixed | vulnerable | fixed | The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the i ... |
| CVE-2026-6324 | vulnerable (no DSA) | vulnerable (no DSA) | vulnerable | fixed | A flaw was found in libsoup. A remote attacker could exploit an unsign ... |
| CVE-2026-5119 | vulnerable (no DSA) | vulnerable (no DSA) | vulnerable | fixed | A flaw was found in libsoup. When establishing HTTPS tunnels through a ... |
| CVE-2026-4271 | vulnerable (no DSA) | vulnerable (no DSA) | vulnerable | fixed | A flaw was found in libsoup, a library for handling HTTP requests. Thi ... |
| CVE-2026-3634 | vulnerable (no DSA) | vulnerable (no DSA) | vulnerable | fixed | A flaw was found in libsoup. An attacker controlling the value used to ... |
| CVE-2026-3633 | vulnerable (no DSA) | vulnerable (no DSA) | vulnerable | fixed | A flaw was found in libsoup. A remote attacker, by controlling the met ... |
| CVE-2026-3632 | vulnerable (no DSA) | vulnerable (no DSA) | vulnerable | vulnerable | A flaw was found in libsoup, a library used by applications to send ne ... |
| CVE-2026-3099 | vulnerable (no DSA) | vulnerable (no DSA) | vulnerable | fixed | A flaw was found in Libsoup. The server-side digest authentication imp ... |
| CVE-2026-2708 | vulnerable (no DSA) | vulnerable (no DSA) | vulnerable | fixed | A request smuggling vulnerability exists in libsoup's HTTP/1 header pa ... |
| CVE-2026-2443 | vulnerable (no DSA) | vulnerable (no DSA) | fixed | fixed | A flaw was identified in libsoup, a widely used HTTP library in GNOME- ... |
| CVE-2026-2436 | vulnerable (no DSA) | vulnerable (no DSA) | vulnerable | fixed | A flaw was found in libsoup's SoupServer. A remote attacker could expl ... |
| CVE-2026-2369 | vulnerable (no DSA) | vulnerable (no DSA) | fixed | fixed | A flaw was found in libsoup. An integer underflow vulnerability occurs ... |
| CVE-2026-1801 | vulnerable (no DSA) | vulnerable (no DSA) | fixed | fixed | A flaw was found in libsoup, an HTTP client/server library. This HTTP ... |
| CVE-2026-1761 | vulnerable (no DSA) | vulnerable (no DSA) | fixed | fixed | A flaw was found in libsoup. This stack-based buffer overflow vulnerab ... |
| CVE-2026-1760 | vulnerable (no DSA) | vulnerable (no DSA) | fixed | fixed | A flaw was found in SoupServer. This HTTP request smuggling vulnerabil ... |
| CVE-2026-1539 | vulnerable (no DSA) | vulnerable (no DSA) | fixed | fixed | A flaw was found in the libsoup HTTP library that can cause proxy auth ... |
| CVE-2026-1536 | vulnerable (no DSA) | vulnerable (no DSA) | fixed | fixed | A flaw was found in libsoup. An attacker who can control the input for ... |
| CVE-2026-1467 | vulnerable (no DSA) | vulnerable (no DSA) | fixed | fixed | A flaw was found in libsoup, an HTTP client library. This vulnerabilit ... |
| CVE-2026-0719 | vulnerable (no DSA) | vulnerable (no DSA) | vulnerable | fixed | A flaw was identified in the NTLM authentication handling of the libso ... |
| CVE-2026-0716 | vulnerable (no DSA) | vulnerable (no DSA) | fixed | fixed | A flaw was found in libsoup\u2019s WebSocket frame processing when han ... |
| CVE-2025-32914 | vulnerable (no DSA) | fixed | fixed | fixed | A flaw was found in libsoup, where the soup_multipart_new_from_message ... |
| CVE-2025-32913 | vulnerable (no DSA) | fixed | fixed | fixed | A flaw was found in libsoup, where the soup_message_headers_get_conten ... |
| CVE-2025-32908 | vulnerable (no DSA) | fixed | fixed | fixed | A flaw was found in libsoup. The HTTP/2 server in libsoup may not full ... |
| CVE-2025-32907 | vulnerable (no DSA) | fixed | fixed | fixed | A flaw was found in libsoup. The implementation of HTTP range requests ... |
| CVE-2025-32049 | vulnerable (no DSA) | vulnerable (no DSA) | vulnerable | fixed | A flaw was found in libsoup. The SoupWebsocketConnection may accept a ... |
| CVE-2025-14523 | vulnerable (no DSA) | vulnerable (no DSA) | fixed | fixed | A flaw in libsoup\u2019s HTTP header handling allows multiple Host: he ... |
| CVE-2025-12105 | vulnerable (no DSA) | vulnerable (no DSA) | fixed | fixed | A flaw was found in the asynchronous message queue handling of the lib ... |
| CVE-2025-11021 | vulnerable (no DSA) | vulnerable (no DSA) | fixed | fixed | A flaw was found in the cookie date handling logic of the libsoup HTTP ... |
| CVE-2025-9901 | vulnerable (no DSA) | vulnerable (no DSA) | vulnerable | vulnerable | A flaw was found in libsoup\u2019s caching mechanism, SoupCache, where ... |
| CVE-2025-4969 | vulnerable (no DSA) | fixed | fixed | fixed | A vulnerability was found in the libsoup package. This flaw stems from ... |
| CVE-2025-4948 | vulnerable (no DSA) | fixed | fixed | fixed | A flaw was found in the soup_multipart_new_from_message() function of ... |
| CVE-2025-4945 | vulnerable (no DSA) | fixed | fixed | fixed | A flaw was found in the cookie parsing logic of the libsoup HTTP libra ... |
| CVE-2025-4476 | vulnerable (no DSA) | fixed | fixed | fixed | A denial-of-service vulnerability has been identified in the libsoup H ... |
| CVE-2025-4035 | vulnerable (no DSA) | vulnerable (no DSA) | vulnerable | vulnerable | A flaw was found in libsoup. When handling cookies, libsoup clients mi ... |