CVE-2026-2443 MEDIUM

CVE-2026-2443: Libsoup: out-of-bounds read in libsoup handle_partial_get() leading to heap information disclosure

Vendor Red Hat
Product Red Hat Enterprise Linux 10
Weakness CWE-125
Published February 13, 2026
Last update March 23, 2026

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access portions of server memory beyond the intended response. Exploitation requires a vulnerable configuration and access to a server using the embedded SoupServer component.

Key dates

02Disclosure timeline

February 13, 2026 CVE published
March 23, 2026 Record updated