CVE-2026-12549

EUVD-2026-38279
The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.8 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 33.81%
Affected Products (NVD)
VendorProductVersion
redhatenterprise_linux
6.0
redhatenterprise_linux
7.0
redhatenterprise_linux
8.0
redhatenterprise_linux
9.0
redhatenterprise_linux
10.0
gnomelibsoup
-
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libsoup2.4
bookworm
2.74.3-1+deb12u1
fixed
bullseye
vulnerable
bullseye (security)
vulnerable
trixie
2.74.3-10.1
fixed
libsoup3
bookworm
3.2.3-0+deb12u2
fixed
forky
vulnerable
sid
vulnerable
trixie
3.6.5-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libsoup2.4
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
xenial
needs-triage
libsoup3
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
Common Weakness Enumeration
References
https://access.redhat.com/security/cve/CVE-2026-12549
https://access.redhat.com/security/cve/cve-2026-0716
https://bugzilla.redhat.com/show_bug.cgi?id=2489999
https://gitlab.gnome.org/GNOME/libsoup/-/work_items/516