An update for libsoup is now available for openEuler-24.03-LTS,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP2,openEuler-24.03-LTS-SP3,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-1449 Final 1.0 1.0 2026-02-28 Initial 2026-02-28 2026-02-28 openEuler SA Tool V1.0 2026-02-28 libsoup security update An update for libsoup is now available for openEuler-24.03-LTS,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP2,openEuler-24.03-LTS-SP3,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4 libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fix(es): A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine Transfer-Encoding: chunked and Connection: keep-alive headers. A remote, unauthenticated client can exploit this by sending specially crafted requests, causing SoupServer to fail to close the connection as required by RFC 9112. This allows the attacker to smuggle additional requests over the persistent connection, leading to unintended request processing and potential denial-of-service (DoS) conditions.(CVE-2026-1760) A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or user interaction by sending specially crafted chunked requests. This allows libsoup to parse and process multiple HTTP requests from a single network message, potentially leading to information disclosure.(CVE-2026-1801) libsoup: libsoup: Buffer overread due to integer underflow when handling zero-length resources(CVE-2026-2369) An update for libsoup is now available for openEuler-24.03-LTS,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP2,openEuler-24.03-LTS-SP3,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium libsoup https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1449 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-1760 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-1801 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-2369 https://nvd.nist.gov/vuln/detail/CVE-2026-1760 https://nvd.nist.gov/vuln/detail/CVE-2026-1801 https://nvd.nist.gov/vuln/detail/CVE-2026-2369 openEuler-24.03-LTS openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP2 openEuler-24.03-LTS-SP3 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 libsoup-help-2.74.3-13.oe2403.noarch.rpm libsoup-help-2.74.3-13.oe2403sp1.noarch.rpm libsoup-help-2.74.3-13.oe2403sp2.noarch.rpm libsoup-help-2.74.3-14.oe2403sp3.noarch.rpm libsoup-help-2.71.0-12.oe2003sp4.noarch.rpm libsoup-help-2.74.2-13.oe2203sp4.noarch.rpm libsoup-2.74.3-13.oe2403.aarch64.rpm libsoup-debuginfo-2.74.3-13.oe2403.aarch64.rpm libsoup-debugsource-2.74.3-13.oe2403.aarch64.rpm libsoup-devel-2.74.3-13.oe2403.aarch64.rpm libsoup-2.74.3-13.oe2403sp1.aarch64.rpm libsoup-debuginfo-2.74.3-13.oe2403sp1.aarch64.rpm libsoup-debugsource-2.74.3-13.oe2403sp1.aarch64.rpm libsoup-devel-2.74.3-13.oe2403sp1.aarch64.rpm libsoup-2.74.3-13.oe2403sp2.aarch64.rpm libsoup-debuginfo-2.74.3-13.oe2403sp2.aarch64.rpm libsoup-debugsource-2.74.3-13.oe2403sp2.aarch64.rpm libsoup-devel-2.74.3-13.oe2403sp2.aarch64.rpm libsoup-2.74.3-14.oe2403sp3.aarch64.rpm libsoup-debuginfo-2.74.3-14.oe2403sp3.aarch64.rpm libsoup-debugsource-2.74.3-14.oe2403sp3.aarch64.rpm libsoup-devel-2.74.3-14.oe2403sp3.aarch64.rpm libsoup-2.71.0-12.oe2003sp4.aarch64.rpm libsoup-debuginfo-2.71.0-12.oe2003sp4.aarch64.rpm libsoup-debugsource-2.71.0-12.oe2003sp4.aarch64.rpm libsoup-devel-2.71.0-12.oe2003sp4.aarch64.rpm libsoup-2.74.2-13.oe2203sp4.aarch64.rpm libsoup-debuginfo-2.74.2-13.oe2203sp4.aarch64.rpm libsoup-debugsource-2.74.2-13.oe2203sp4.aarch64.rpm libsoup-devel-2.74.2-13.oe2203sp4.aarch64.rpm libsoup-2.74.3-13.oe2403.src.rpm libsoup-2.74.3-13.oe2403sp1.src.rpm libsoup-2.74.3-13.oe2403sp2.src.rpm libsoup-2.74.3-14.oe2403sp3.src.rpm libsoup-2.71.0-12.oe2003sp4.src.rpm libsoup-2.74.2-13.oe2203sp4.src.rpm libsoup-2.74.3-13.oe2403.x86_64.rpm libsoup-debuginfo-2.74.3-13.oe2403.x86_64.rpm libsoup-debugsource-2.74.3-13.oe2403.x86_64.rpm libsoup-devel-2.74.3-13.oe2403.x86_64.rpm libsoup-2.74.3-13.oe2403sp1.x86_64.rpm libsoup-debuginfo-2.74.3-13.oe2403sp1.x86_64.rpm libsoup-debugsource-2.74.3-13.oe2403sp1.x86_64.rpm libsoup-devel-2.74.3-13.oe2403sp1.x86_64.rpm libsoup-2.74.3-13.oe2403sp2.x86_64.rpm libsoup-debuginfo-2.74.3-13.oe2403sp2.x86_64.rpm libsoup-debugsource-2.74.3-13.oe2403sp2.x86_64.rpm libsoup-devel-2.74.3-13.oe2403sp2.x86_64.rpm libsoup-2.74.3-14.oe2403sp3.x86_64.rpm libsoup-debuginfo-2.74.3-14.oe2403sp3.x86_64.rpm libsoup-debugsource-2.74.3-14.oe2403sp3.x86_64.rpm libsoup-devel-2.74.3-14.oe2403sp3.x86_64.rpm libsoup-2.71.0-12.oe2003sp4.x86_64.rpm libsoup-debuginfo-2.71.0-12.oe2003sp4.x86_64.rpm libsoup-debugsource-2.71.0-12.oe2003sp4.x86_64.rpm libsoup-devel-2.71.0-12.oe2003sp4.x86_64.rpm libsoup-2.74.2-13.oe2203sp4.x86_64.rpm libsoup-debuginfo-2.74.2-13.oe2203sp4.x86_64.rpm libsoup-debugsource-2.74.2-13.oe2203sp4.x86_64.rpm libsoup-devel-2.74.2-13.oe2203sp4.x86_64.rpm A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine Transfer-Encoding: chunked and Connection: keep-alive headers. A remote, unauthenticated client can exploit this by sending specially crafted requests, causing SoupServer to fail to close the connection as required by RFC 9112. This allows the attacker to smuggle additional requests over the persistent connection, leading to unintended request processing and potential denial-of-service (DoS) conditions. 2026-02-28 CVE-2026-1760 openEuler-24.03-LTS openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP2 openEuler-24.03-LTS-SP3 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 Medium 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L libsoup security update 2026-02-28 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1449 A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or user interaction by sending specially crafted chunked requests. This allows libsoup to parse and process multiple HTTP requests from a single network message, potentially leading to information disclosure. 2026-02-28 CVE-2026-1801 openEuler-24.03-LTS openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP2 openEuler-24.03-LTS-SP3 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 Medium 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N libsoup security update 2026-02-28 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1449 libsoup: libsoup: Buffer overread due to integer underflow when handling zero-length resources 2026-02-28 CVE-2026-2369 openEuler-24.03-LTS openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP2 openEuler-24.03-LTS-SP3 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 Medium 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L libsoup security update 2026-02-28 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1449