Ubuntu fixes libsoup cookie-jar leak from USN-8890-1
Original title: USN-8890-3: libsoup regression
The follow-up also restates HTTP/2 denial of service and HTTPS proxy disclosure, including CVE-2026-4271.
Ubuntu issued USN-8890-3 because USN-8890-1, which fixed libsoup vulnerabilities, introduced a cookie-jar memory leak and could cause a regression. The new update corrects that problem. Original details say mishandled HTTP/2 requests could let a remote attacker cause denial of service on Ubuntu 24.04 LTS and 26.04 LTS (CVE-2026-4271), and mishandled HTTPS proxy connections could expose sensitive information on Ubuntu 22.04 LTS and 24.04. Exploitation is not mentioned.
Unconfirmed: The notice snippet is cut off, so the second issue's full affected range and any further CVEs are unknown.
- USN-8890-1 introduced a memory leak in the libsoup cookie jar.
- CVE-2026-4271 affects only Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.
- The HTTPS proxy issue can expose sensitive information to a remote attacker.
- The snippet does not name fixed package versions.
Impact: Denial of service or disclosure of sensitive information
| Product | Affected |
|---|---|
| Ubuntu libsoup | Ubuntu 24.04 LTS and Ubuntu 26.04 LTS |
| Ubuntu libsoup | Ubuntu 22.04 LTS, Ubuntu 24.04 |
- 1.Install the updated libsoup packages from USN-8890-3.
- CVEs
- CVE-2026-4271
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-4271 | libsoup: This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by… | 7.5 | <1% | PoC |
From the original article
USN-8890-1 fixed vulnerabilities in libsoup. Unfortunately, that update introduced a memory leak in the cookie jar and could introduce a regression. This update fixes the problem.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.