{"schemaVersion":3,"id":"USN-8523-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"libsoup2.4 vulnerabilities\n\nEric Su and Samuel Dainard discovered that libsoup incorrectly handled\ncontent with zero-length resources. An attacker could possibly use this\nissue to trigger a buffer over-read, resulting in information disclosure\nor a denial of service. This issue only affected Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and\nUbuntu 26.04 LTS. (CVE-2026-2369)\n\nKona Arctic discovered that libsoup did not properly protect sensitive\ncookies when establishing HTTPS tunnels through an HTTP proxy. An\nattacker could possibly use this issue to intercept session cookies,\nresulting in session hijacking or user impersonation. (CVE-2026-5119)","dates":{"published":"2026-07-09T14:13:33.000Z","modified":"2026-07-10T02:35:14.340Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"libsoup2.4","name":"libsoup2.4","label":"libsoup2.4","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/libsoup2.4","purlType":"deb","versions":[{"text":"< 2.52.2-1ubuntu0.3+esm6","noFixRecorded":false,"fixedIn":null},{"text":"< 2.62.1-1ubuntu0.4+esm7","noFixRecorded":false,"fixedIn":null},{"text":"< 2.70.0-1ubuntu0.5+esm2","noFixRecorded":false,"fixedIn":null},{"text":"< 2.74.2-3ubuntu0.7","noFixRecorded":false,"fixedIn":null},{"text":"< 2.74.3-6ubuntu1.7","noFixRecorded":false,"fixedIn":null},{"text":"< 2.74.3-10.1ubuntu4.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.74.3-10.1ubuntu5+esm1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.52.2-1ubuntu0.3+esm6 | < 2.62.1-1ubuntu0.4+esm7 | < 2.70.0-1ubuntu0.5+esm2 | < 2.74.2-3ubuntu0.7 | < 2.74.3-6ubuntu1.7 | < 2.74.3-10.1ubuntu4.1 | < 2.74.3-10.1ubuntu5+esm1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-8523-1","label":"ubuntu.com/security/notices/USN-8523-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-2369","label":"ubuntu.com/security/CVE-2026-2369","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-5119","label":"ubuntu.com/security/CVE-2026-5119","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2026-2369","CVE-2026-5119"],"downstream":[],"duplicates":[],"related":["CVE-2026-2369","CVE-2026-5119"]},"timeline":[{"kind":"published","date":"2026-07-09T14:13:33.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-07-10T02:35:14.340Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T13:36:42.304Z","stale":false,"partial":false}}