OESA-2026-2337 libsoup3 security update

🗓️ 15 May 2026 14:02:34Reported by GoogleType

osv

osv🔗 osv.dev👁 12 Views

Libsoup3 security update fixes use-after-free, host header issues, and cookie parsing overflow.

Reporter	Title	Published	Views	Family All 1007
Vulnrichment	CVE-2025-4945 Libsoup: integer overflow in cookie expiration date handling in libsoup	19 May 202517:03	–	vulnrichment
Vulnrichment	CVE-2025-4948 Libsoup: integer underflow in soup_multipart_new_from_message() leading to denial of service in libsoup	19 May 202515:55	–	vulnrichment
Vulnrichment	CVE-2025-4969 Libsoup: off-by-one out-of-bounds read in find_boundary() in soup-multipart.c	21 May 202501:44	–	vulnrichment
Vulnrichment	CVE-2026-0716 Libsoup: out-of-bounds read in libsoup websocket frame processing	13 Jan 202623:07	–	vulnrichment
Vulnrichment	CVE-2026-1467 Libsoup: libsoup: http header injection via specially crafted urls when an http proxy is configured	27 Jan 202609:17	–	vulnrichment
Vulnrichment	CVE-2026-1536 Libsoup: libsoup: http header injection or response splitting via crlf injection in content-disposition header	28 Jan 202615:15	–	vulnrichment
Vulnrichment	CVE-2026-1539 Libsoup: libsoup: credential leakage via http redirects	28 Jan 202615:15	–	vulnrichment
Vulnrichment	CVE-2025-12105 Libsoup: heap use-after-free in libsoup message queue handling during http/2 read completion	23 Oct 202509:14	–	vulnrichment
Vulnrichment	CVE-2025-14523 Libsoup: libsoup: duplicate host header handling causes host-parsing discrepancy (first- vs last-value wins)	11 Dec 202512:30	–	vulnrichment
Vulnrichment	CVE-2025-46420 Libsoup: memory leak on soup_header_parse_quality_list() via soup-headers.c	24 Apr 202512:58	–	vulnrichment

Source	Link
openeuler	www.openeuler.org/zh/security/security-bulletins/detail/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-12105
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-14523
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-46420
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-4945
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-4948
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-4969
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-0716
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-1467
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-1536

15 May 2026 14:15Current

6Medium risk

Vulners AI Score6

CVSS 3.15.8 - 8.2

EPSS0.00765

SSVC

use after free host header duplicates cookie parsing overflow memory leaks