USN-8890-1: libsoup vulnerabilities
Ubuntu fixed libsoup flaws that could cause denial of service, leak proxy data, or bypass security checks.
Ubuntu published USN-8890-1 for libsoup. CVE-2026-4271 is an HTTP/2 handling flaw that a remote attacker could use for denial of service on Ubuntu 24.04 LTS and 26.04 LTS. CVE-2026-5119 involves incorrect HTTPS proxy handling that could expose sensitive information on Ubuntu 22.04, 24.04, and 26.04 LTS. A separate chunked HTTP parsing issue could let a remote attacker bypass security controls; the notice is truncated before naming that CVE. No exploitation is reported.
- CVE-2026-4271: bad HTTP/2 handling can cause remote denial of service.
- CVE-2026-5119: HTTPS proxy handling may leak sensitive information.
- A chunked-request parsing flaw may bypass security controls.
- Impacted releases are Ubuntu 22.04, 24.04, and 26.04 LTS, depending on the bug.
- The notice does not report exploitation in the wild.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-4271 | libsoup: This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by… | 7.5 | <1% | PoC | |
| CVE-2026-5119 | libsoup: When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within… | 8.2 | <1% | PoC |
From the original article
It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.