CVE-2026-77680

Что произошло

An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N²) work coalescing them into a single range. The vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required. The number of ranges is bounded only by the maximum request header size (~100 KiB), allowing roughly 25,000 ranges per request. Reporter measurements on libsoup HEAD containing the CVE-2025-32907 fix show ~90 ms single-core CPU per such request at the wire maximum, blocking the server's event loop for that duration. This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs. Affected: libsoup versions containing the CVE-2025-32907 fix but not merge request !550. Fixed upstream: MR !550 merged 2026-08-20, replacing per-element removal with O(N) in-place compaction and rejecting Range headers requesting more than 200 ranges. Upstream report: https://gitlab.gnome.org/GNOME/libsoup/-/issues/538 Related: CVE-2025-32907

Что делать

dpkg-query -W -f='${Package}	${Version}\n'

rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n'

Get-HotFix | Select-Object HotFixID, InstalledOn

Продукты и затронутые версии

cpe:/a:redhat:enterprise_linux:10

CVSS: оценки и векторы

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Источники и ссылки

{
  "cwes": [
    "cve",
    "nvd"
  ],
  "epss": {
    "source": "epss",
    "received_at": "2026-11-06T21:15:31.522158+00:00"
  },
  "title": {
    "source": "cve",
    "received_at": "2026-11-06T00:51:14.523506+00:00"
  },
  "scores": [
    "cve",
    "nvd"
  ],
  "status": {
    "source": "cve",
    "received_at": "2026-11-06T00:51:14.523506+00:00"
  },
  "affected": [
    "cve"
  ],
  "published": {
    "source": "cve",
    "received_at": "2026-11-06T00:51:14.523506+00:00"
  },
  "solutions": [],
  "percentile": {
    "source": "epss",
    "received_at": "2026-11-06T21:15:31.522158+00:00"
  },
  "references": [
    "cve",
    "nvd"
  ],
  "description": {
    "source": "cve",
    "received_at": "2026-11-06T00:51:14.523506+00:00"
  },
  "workarounds": [
    "cve"
  ],
  "configurations": []
}

Хронология записи

1. Данные обновлены07.11.2026, 00:15
2. Данные обновлены06.11.2026, 04:33
3. Данные обновлены06.11.2026, 03:51
4. Данные обновлены06.11.2026, 00:16
5. Данные обновлены05.11.2026, 00:20
6. Данные обновлены04.11.2026, 00:15
7. Данные обновлены03.11.2026, 00:14
8. Данные обновлены02.11.2026, 00:12
9. Данные обновлены31.10.2026, 11:59
10. Данные обновлены29.10.2026, 12:41
11. Появилась ссылка на PoC28.10.2026, 23:24

Личная заметка и статус

Другие CVE того же продукта