CVE-2026-6324
A flaw was found in libsoup
- Risk score
- 46/100
- CVSS
- 4.8 v3.1
- Exploit chance (30 days)
- 0.9%
- Published
- 29 May 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soup_body_input_stream_read_chunked() function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backen…
- Affected
- Canonical Ubuntu Linux
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Canonical Ubuntu Linux: Amber, patch this week. U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.
The flaws
- CVE-2026-6324: A flaw was found in libsoup (CVSS 4.8 · EPSS 1%)
- CVE-2026-74221: Denial of service (CVSS 8.2 · EPSS 0%)
- CVE-2026-74220: Denial of service (CVSS 8.2 · EPSS 0%)
- CVE-2026-103262: Denial of service (CVSS 7.5 · EPSS 1%)
The fix
Upgrade Canonical Ubuntu Linux: 2026.10 · 6.5.9 or later on your release line
Who is exposed: Canonical Ubuntu Linux before 2026.10
Where it stands
- No known exploitation
How it unfolded
- 21 Oct, Ubuntu security notices (official): USN-8930-2: U-Boot vulnerabilities
- 21 Oct, Ubuntu security notices (official): USN-8890-2: libsoup vulnerabilities
- 22 Oct, Ubuntu security notices (official): USN-8952-1: Tornado vulnerabilities
Connects to
- Same weakness: CWE-444 (CWE-444). 28 other warnings in 30 days
- Same product: Earlier Canonical Ubuntu Linux warnings. 15 in the last 90 days
Why it is Yellow
- CVSS 4.8 medium
- Named in a government or vendor bulletin
Government and vendor bulletins
References
Original description
A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the `soup_body_input_stream_read_chunked()` function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.
Last activity 21 Oct 2026. Patch Forecast updates every hour.