CVE-2026-77014

EUVD-2026-63225
A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 14.36%
Debian logo
Debian Releases
Debian Product
Codename
libsoup2.4
bookworm
vulnerable
bullseye
vulnerable
bullseye (security)
vulnerable
trixie
vulnerable
libsoup3
bookworm
vulnerable
forky
vulnerable
sid
vulnerable
trixie
vulnerable
Common Weakness Enumeration
References
https://access.redhat.com/security/cve/CVE-2026-77014
https://bugzilla.redhat.com/show_bug.cgi?id=2520143
https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/550