← Back

CVE-2026-12549

nvd nist
Published: Jun 22, 2026Modified: Jul 8, 2026

JSON object

Loading...
4.8
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Exploitability: 2.2 / Impact: 2.5
Source: secalert@redhat.com (Secondary)

Description

The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding.

Affected (6)

Redhat
1 product
Enterprise Linux
Gnome
1 product
Libsoup
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Redhat
Enterprise Linux
Version 10.0
Enterprise Linux
Version 6.0
Enterprise Linux
Version 7.0
Enterprise Linux
Version 8.0
Enterprise Linux
Version 9.0
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Libsoup
All versions

Related CWEs

CWE-805
Buffer Access with Incorrect Length Value
The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.

References (4)

Source: secalert@redhat.com
Vendor AdvisoryMitigation
Source: secalert@redhat.com
Vendor AdvisoryMitigation
Source: secalert@redhat.com
Issue TrackingVendor Advisory
Source: secalert@redhat.com
ExploitIssue TrackingPatchVendor Advisory

Timeline

No history available yet.