{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"libsoup3","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-77680","cwes":["CWE-407"],"description":"An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix.\n\nCVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N²) work coalescing them into a single range.\n\nThe vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required. The number of ranges is bounded only by the maximum request header size (~100 KiB), allowing roughly 25,000 ranges per request. Reporter measurements on libsoup HEAD containing the CVE-2025-32907 fix show ~90 ms single-core CPU per such request at the wire maximum, blocking the server's event loop for that duration.\n\nThis is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs.\n\nAffected: libsoup versions containing the CVE-2025-32907 fix but not merge request !550.\nFixed upstream: MR !550 merged 2026-08-20, replacing per-element removal with O(N) in-place compaction and rejecting Range headers requesting more than 200 ranges.\nUpstream report: https://gitlab.gnome.org/GNOME/libsoup/-/issues/538\nRelated: CVE-2025-32907","epss":{"date":"2026-11-05","percentile":0.28073,"score":0.00344},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://gitlab.gnome.org/GNOME/libsoup/-/issues/538"}],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}],"modifiedAt":1793925932456,"publishedAt":1787690205808,"references":[{"source":"CNA: redhat","tags":["technical-description","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2025-32907"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-77680"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520892"},{"source":"CNA: redhat","tags":[],"url":"https://gitlab.gnome.org/GNOME/libsoup/-/issues/538"},{"source":"CNA: redhat","tags":[],"url":"https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/550"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://gitlab.gnome.org/GNOME/libsoup/-/issues/538"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Upgrade to a libsoup version containing merge request !550 (O(N) range coalescing and 200-range limit). Until patched, restrict network access to services using SoupServer, or terminate connections that send Range headers with excessive range counts."}],"revision":"f4c6a008ce5de536224c5c0d31c936b8c8c1ea8dc3096c8aa21f632258c37661","sources":[{"modifiedAt":1793925932456,"name":"CNA: redhat","retrievedAt":1793927322005,"url":"https://www.cve.org/CVERecord?id=CVE-2026-77680"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793927327424,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77680"}],"ssvc":{"assessedAt":1787747938296,"automatable":"yes","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix","updatedAt":1793927327424}