Source: libsoup3 Version: 3.6.6-1 Severity: important Tags: security upstream Forwarded: https://gitlab.gnome.org/GNOME/libsoup/-/issues/508 X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for libsoup3. CVE-2026-6324[0]: | A flaw was found in libsoup. A remote attacker could exploit an | unsigned to signed conversion error in the | `soup_body_input_stream_read_chunked()` function by sending a | malicious HTTP request. This vulnerability occurs when libsoup | operates behind a non-libsoup proxy server or as a proxy in front of | a non-libsoup backend server. Successful exploitation can allow an | attacker to bypass security controls, poison web caches, or gain | unauthorized access. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-6324 https://www.cve.org/CVERecord?id=CVE-2026-6324 [1] https://gitlab.gnome.org/GNOME/libsoup/-/issues/508 [2] https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/517 [3] https://gitlab.gnome.org/GNOME/libsoup/-/commit/96ac392b444d01bd5de1d1276b187c3ed49d048c Please adjust the affected versions in the BTS as needed. Regards, Salvatore
