CVE-2026-2443: gnome libsoup Out-of-bounds Read
Vulnerability summary
CVE-2026-2443 is a medium (CVSS 5.3) Out-of-bounds Read vulnerability in gnome libsoup. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 40.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 14 · Related 14Timeline
- 13-02-2026PublishedVulnerability first disclosed.
- 23-03-2026Last modifiedVulnerability information updated.
Description
A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access portions of server memory beyond the intended response. Exploitation requires a vulnerable configuration and access to a server using the embedded SoupServer component.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.49%
Chance of exploitation in the next 30 days
Percentile
41%
Versus all other CVEs
30-day change
+0.04 pp
From 0.45% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- libsoup2.4All versions (No fix recorded)
- libsoup3All versions (No fix recorded) | < 3.6.6-1
Ubuntu2 products
- libsoup2.4All versions (No fix recorded)
- libsoup3All versions (No fix recorded)
Gnome1 product
- libsoupna
Redhat1 product
- enterprise_linuxEOL6.0 | 7.0 | 8.0 | 9.0 | 10.0
4 vendors · 6 products
