CVE-2026-2369 is a medium severity flaw (CVSS 6.5) in libsoup, the GNOME HTTP library. An integer underflow when processing a zero length resource leads to a buffer overread, which could expose information or cause an application level denial of service. Install the update your distribution lists for this CVE.
What's affected
The record names GNOME libsoup and does not give a version range or a fixed version. Red Hat's CVE page says Red Hat Enterprise Linux and Fedora systems that use libsoup are affected when applications process such malformed content. Red Hat rates it moderate, and notes its score may differ from NVD's because it depends on vendor build factors.
Red Hat states that a mitigation is either not available or not currently listed. Track the upstream issue, GNOME libsoup issue 498, and your distribution's advisory for the fixed package version.
libsoup is a shared library. Many desktop applications and tools use it for HTTP, so a single host can contain several programs that load it.
How to check if you're exposed
See which libsoup packages are installed and which programs use them:
rpm -qa | grep -i libsoup
dpkg -l | grep -i libsoup
pkg-config --modversion libsoup-3.0
Then check your distribution's security tracker for CVE-2026-2369 to see the package version that fixes it. Red Hat customers can use the CVE page linked in the sources. Server side programs that fetch or proxy content from untrusted sources matter most, since they process content an attacker can influence.
What to do now
- Check your distribution advisory for CVE-2026-2369 and note the fixed package.
- Update libsoup and restart applications that use it, since a loaded library stays in memory.
- Prioritize hosts where programs fetch content from untrusted servers.
- Include shared libraries like this in your software inventory so the next advisory is quick to map.
Why it matters
The weakness is CWE-191 (Integer Underflow). A length calculation goes below zero for an empty resource, wraps around to a very large number, and the code then reads far past the end of its buffer. A zero length input is an edge case that is easy to miss in testing.
The CVSS vector scores network reach with limited confidentiality and availability impact, which is why the rating is medium. A read past the end of a buffer can leak nearby memory, or crash the program. The record does not mark this CVE as exploited in the wild. For most systems this belongs in the normal update cycle, sooner for programs that handle hostile content.
Quick check
Is there a workaround?
Red Hat says a mitigation is not available or not currently listed, so update the package.
Why restart applications after updating?
A running program keeps the old library loaded until it restarts.
Sources
Last reviewed: 19 October 2026.
