Ubuntu Patches Critical libsoup Vulnerabilities Affecting Web Apps
Multiple high-severity flaws in libsoup impact Ubuntu systems, exposing them to DoS and data leaks. Patches now available for several LTS versions.
TL;DR
- Ubuntu released USN-8890-2 addressing multiple libsoup vulnerabilities in HTTP/2 and HTTPS handling.
- Issues include denial-of-service risks, credential exposure, and HTTP request smuggling potential.
- Affects Ubuntu 22.04, 24.04, and 26.04 LTS—organizations should patch immediately.
- The flaw impacts applications relying on libsoup for network communication.
- Agent Breach recommends reviewing dependencies and applying updates to mitigate risk.
Ubuntu has published security update USN-8890-2, resolving multiple vulnerabilities in the libsoup library. These issues affect core networking functionality used by many applications, potentially leading to denial of service, unauthorized data access, and bypass of security controls. Organizations using Ubuntu LTS releases should prioritize patching to avoid exploitation.
The vulnerabilities stem from improper handling of HTTP/2 requests, HTTPS proxy connections, chunked transfer encoding, proxy credentials, and HTTP range headers. Exploitation could allow attackers to disrupt services or gain access to sensitive information. Developers and system administrators managing web-facing applications must act swiftly to apply these fixes.
Key Vulnerabilities Addressed
- CVE-2026-4271: HTTP/2 mishandling can lead to denial of service; affects Ubuntu 24.04 and 26.04.
- CVE-2026-5119: Incorrect HTTPS proxy handling may leak sensitive data; affects 22.04, 24.04, and 26.04.
- CVE-2026-6324: Flawed parsing of chunked requests enables control bypass; affects 22.04, 24.04, and 26.04.
- CVE-2026-66339: Proxy authentication credentials improperly handled, risking exposure across versions.
Impact and Recommendations
- Applications using libsoup for HTTP communication are at risk, especially those processing untrusted input.
- Organizations running Ubuntu 22.04, 24.04, or 26.04 LTS should update affected packages immediately.
- Review third-party libraries and dependencies that rely on libsoup to ensure full remediation.
- Monitor systems for unusual traffic patterns or unexpected behavior post-patch deployment.
- Use automated tools like Agent Breach to track vulnerability disclosures affecting your stack.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.