Ubuntu patches libsoup3 flaws on 26.10 in USN-8890-2
Original title: USN-8890-2: libsoup vulnerabilities
The notice backports earlier libsoup fixes, including an HTTP/2 denial of service and an HTTPS proxy information leak.
USN-8890-2 supplies for libsoup3 on Ubuntu 26.10 the fixes first published in USN-8890-1. The original notice says mishandled HTTP/2 requests could let a remote attacker cause a denial of service, affecting only Ubuntu 24.04 LTS and 26.04 LTS (CVE-2026-4271). Mishandled HTTPS proxy connections could expose sensitive information on Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS (CVE-2026-5119). A further parsing issue is mentioned, but the available text is cut off before its details.
Unconfirmed: The notice is cut off before the remaining parsing flaw and any package versions are given.
- This update covers libsoup3 on Ubuntu 26.10.
- CVE-2026-4271 is limited to Ubuntu 24.04 LTS and 26.04 LTS.
- CVE-2026-5119 affects Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS.
- No exploitation status is stated.
Impact: Denial of service or disclosure of sensitive information
| Product | Affected |
|---|---|
| Ubuntu libsoup3 | Ubuntu 26.10 |
| Ubuntu libsoup | Ubuntu 24.04 LTS and 26.04 LTS for CVE-2026-4271; 22.04 LTS, 24.04 LTS, and 26.04 LTS for CVE-2026-5119 |
- 1.Install the USN-8890-2 libsoup3 updates on Ubuntu 26.10.
- Vendors
- Ubuntu
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-4271 | libsoup: This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by… | 7.5 | <1% | PoC | |
| CVE-2026-5119 | libsoup: When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within… | 8.2 | <1% | PoC |
From the original article
USN-8890-1 fixed vulnerabilities in libsoup. This update provides the corresponding updates for libsoup3 on Ubuntu 26. 10.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.