CVE-2026-6324
Publication date 29 May 2026
Last updated 6 October 2026
Ubuntu priority
Description
A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the `soup_body_input_stream_read_chunked()` function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| libsoup2.4 | 26.04 LTS resolute | Ignored changes too intrusive |
| 24.04 LTS noble | Ignored changes too intrusive | |
| 22.04 LTS jammy | Ignored changes too intrusive | |
| 20.04 LTS focal | Ignored changes too intrusive | |
| 18.04 LTS bionic | Ignored changes too intrusive | |
| 16.04 LTS xenial | Ignored changes too intrusive | |
| libsoup3 | 26.04 LTS resolute |
Fixed 3.6.6-1ubuntu0.1
|
| 24.04 LTS noble |
Fixed 3.4.4-5ubuntu0.9
|
|
| 22.04 LTS jammy |
Fixed 3.0.7-0ubuntu1+esm9
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialSeverity score breakdown
CVSS version: CVSS v3.0
Base score
4.8 · Medium
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
References
Related Ubuntu Security Notices (USN)
- USN-8890-1
- libsoup vulnerabilities
- 6 October 2026
Other references
- https://www.cve.org/CVERecord?id=CVE-2026-6324
- https://gitlab.gnome.org/GNOME/libsoup/-/issues/508
- https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/517
- https://gitlab.gnome.org/GNOME/libsoup/-/commit/96ac392b444d01bd5de1d1276b187c3ed49d048c (3.7.1)
- https://access.redhat.com/security/cve/CVE-2026-6324
- https://bugzilla.redhat.com/show_bug.cgi?id=2458479