Back Linuxsecurity

Fedora 43 libsoup3 Major Remote DoS and Buffer Overread CVEs Update

Linuxsecurity •LinuxSecurity Advisories • September 10, 2026

Share: View original

Keep your Linux systems secure and up to date with practical patching guidance. Review Linux Patching Best Practices ×

Libsoup is an HTTP library implementation in C. It was originally part

of a SOAP (Simple Object Access Protocol) implementation called Soup, but

the SOAP and non-SOAP parts have now been split into separate packages.

libsoup uses the Glib main loop and is designed to work well with GTK

applications. This enables GNOME applications to access HTTP servers

on the network in a completely asynchronous fashion, very similar to

the Gtk+ programming model (a synchronous operation mode is also

supported for those who want it), but the SOAP parts were removed

Fixes lots of CVEs: see the fixes section for details

* Sat Sep 5 2026 Adrian Vovk - 3.6.6-5 - Backport various CVE fixes

[ 1 ] Bug #2500132 - CVE-2026-15712 libsoup3: libsoup: HTTP/2 GOAWAY frame parsing heap buffer over-read via invalid NUL-termination assumption [fedora-all] [ 2 ] Bug #2500489 - CVE-2026-15709 libsoup3: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service [fedora-all] [ 3 ] Bug #2500545 - CVE-2026-15711 libsoup3: libsoup: WebSocket remote denial of service via oversized control frame protocol violation [fedora-all] [ 4 ] Bug #2500551 - CVE-2026-15713 libsoup3: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak [fedora-all] [ 5 ] Bug #2500553 - CVE-2026-15714 libsoup3: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers via an oversized multipart b...

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-fce2f41203' at the command line. For more information, refer to the dnf documentation available at

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CVEs in Fedora libsoup3 Require Immediate Attention Fedora has released important updates for libsoup3, an HTTP library, addressing multiple critical CVEs. The vulnerabilities include CVE-2026-15712, CVE-2026-15709, CVE-2026-15711, CVE-2026-15713, and CVE-2026-15714, all published on July 14, 2026. These flaws can lead to remote denial of service attacks and buffer over-read issues, affecting systems running Fedora 43 and 44. The updates were backported by Adrian Vovk on September 5, 2026, and users are advised to apply the patches using the 'dnf' update program. The vulnerabilities pose a significant risk, as they can be exploited to disrupt services and potentially lead to system crashes. Administrators should prioritize applying these updates to mitigate risks associated with these vulnerabilities. 3 sources 61

Extracted Entities

Fedora 43 libsoup3 Major Remote DoS and Buffer Overread CVEs Update

The full story

Extracted Entities

Attack Types (1)

CVEs (5)

CWE Weaknesses (1)

Platforms (1)