CVE Tools
Track your stack

Libsoup

65 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Libsoup, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Libsoup CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Libsoup CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-0418
2025-053
2025-060
2025-070
2025-080
2025-091
2025-101
2025-110
2025-121
2026-015
2026-024
2026-038
2026-041
2026-051
2026-061
2026-074
2026-080
2026-096
2026-100
2026-110

Severity

How the 65 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical46%
  • High2234%
  • Medium3452%
  • Low58%

Latest CVEs

The 15 most recently published vulnerabilities affecting Libsoup.

  1. CVE-2026-102560Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth8.6
  2. CVE-2026-102559Libsoup: libsoup: heap buffer overflow during websocket client-frame masking8.6
  3. CVE-2026-102558Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth8.6
  4. CVE-2026-102555Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decoding8.2
  5. CVE-2026-102557Libsoup: libsoup: heap buffer overflow during websocket message reassembly8.6
  6. CVE-2026-102556Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion8.6
  7. CVE-2026-66337Libsoup: libsoup: heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()6.5
  8. CVE-2026-66338Libsoup: libsoup: http request smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked()5.4
  9. CVE-2026-66339Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels6.5
  10. CVE-2026-12548Libsoup: heap out-of-bounds read in libsoup due to integer truncation4.2
  11. CVE-2026-12549Libsoup: incomplete fix for cve-2026-2443: range suffix overflow in libsoup soupserver4.8
  12. CVE-2026-6324Libsoup: libsoup: http request smuggling via unsigned to signed conversion error4.8
  13. CVE-2026-2708Libsoup: libsoup: http request smuggling via duplicate content-length headers3.7
  14. CVE-2026-5119Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment5.9
  15. CVE-2026-2436Libsoup: libsoup: denial of service via use-after-free in soupserver during tls handshake6.5

Product grouping is registry-driven, with AI assist and human review. How it works