CVE-2026-12549
Libsoup: incomplete fix for cve-2026-2443: range suffix overflow in libsoup soupserver
Description
The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding.
INFO
Published Date :
June 22, 2026, 1:55 p.m.
Last Modified :
June 22, 2026, 1:55 p.m.
Remotely Exploit :
Yes !
Source :
redhat
Affected Products
The following products are affected by CVE-2026-12549
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | 53f830b8-0a3f-465b-8143-3b8a9948e749 |
Solution
- Revert the rework commit that removed overflow checks.
- Reimplement specific overflow checks for Range requests.
- Ensure negative start values are properly clamped.
- Fix malformed HTTP 206 responses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-12549 vulnerability anywhere in the article.