VulnerabilityAwaiting Analysis

CVE-2026-77014

A flaw was found in libsoup's SoupServer HTTP Range header processing.

MEDIUM 5.3EPSS 0.23%

Does this matter?

Lower severity and a low EPSS score (0.23%). Track it; it rarely justifies an emergency change on its own.

Description

A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS: 0.23% probability · 14th percentile
CISA KEV: Not listed
Weakness: CWE-197
Source: secalert@redhat.com

References

https://access.redhat.com/security/cve/CVE-2026-77014
https://bugzilla.redhat.com/show_bug.cgi?id=2520143
https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/550

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.