SUSE alert SUSE-SU-2026:24368-1 (libsoup)

Lwn • October 27, 2026

# Security update for libsoup Announcement ID: SUSE-SU-2026:24368-1 Release Date: 2026-10-21T09:15:58Z Rating: important References: * bsc#1271446 * bsc#1271447 * bsc#1271448 * bsc#1271449 * bsc#1272195 * bsc#1272196 * bsc#1273156 * bsc#1283299 * bsc#1283300 * bsc#1283301 * bsc#1283302 * bsc#1283303 * bsc#1283304 * bsc#1283831 Cross-References: * CVE-2026-102555 * CVE-2026-102556 * CVE-2026-102557 * CVE-2026-102558 * CVE-2026-102559 * CVE-2026-102560 * CVE-2026-103399 * CVE-2026-12547 * CVE-2026-12548 * CVE-2026-15711 * CVE-2026-15712 * CVE-2026-15713 * CVE-2026-15714 * CVE-2026-2708 * CVE-2026-66339 CVSS scores: * CVE-2026-102555 ( SUSE ): 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-102555 ( SUSE ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H * CVE-2026-102555 ( NVD ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H * CVE-2026-102556 ( SUSE ): 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N * CVE-2026-102556 ( SUSE ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H * CVE-2026-102556 ( NVD ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H * CVE-2026-102557 ( SUSE ): 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N * CVE-2026-102557 ( SUSE ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H * CVE-2026-102557 ( NVD ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H * CVE-2026-102558 ( SUSE ): 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N * CVE-2026-102558 ( SUSE ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H * CVE-2026-102558 ( NVD ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H * CVE-2026-102559 ( SUSE ): 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N * CVE-2026-102559 ( SUSE ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H * CVE-2026-102559 ( NVD ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H * CVE-2026-102559 ( NVD ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H * CVE-2026-102560 ( SUSE ): 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N * CVE-2026-102560 ( SUSE ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H * CVE-2026-102560 ( NVD ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H * CVE-2026-102560 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2026-103399 ( SUSE ): 9.1 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-103399 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2026-103399 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2026-12547 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-12547 ( SUSE ): 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N * CVE-2026-12547 ( NVD ): 3.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N * CVE-2026-12548 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-12548 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L * CVE-2026-12548 ( NVD ): 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L * CVE-2026-15711 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-15711 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-15712 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-15712 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-15713 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-15713 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-15714 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L * CVE-2026-15714 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L * CVE-2026-2708 ( SUSE ): 8.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-2708 ( SUSE ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N * CVE-2026-2708 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2026-2708 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2026-66339 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-66339 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2026-66339 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Affected Products: * SUSE Linux Micro 6.0 An update that solves 15 vulnerabilities can now be installed. ## Description: This update for libsoup fixes the following issues: * CVE-2026-12547: Header "Proxy-Authorization" leads to credentials being send to different proxy after proxy switch (bsc#1272195). * CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation (bsc#1272196). * CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol violation (bsc#1271446). * CVE-2026-15712: SoupClientMessageIOHTTP2: HTTP/2 GOAWAY frame parsing heap buffer over-read via invalid NUL- termination assumption (bsc#1271447). * CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak (bsc#1271448). * CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers via an oversized multipart boundary string (bsc#1271449). * CVE-2026-66339: proxy credentials leak to destination server via `Proxy- Authorization` header in CONNECT tunnels (bsc#1273156). * CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding (bsc#1283299). * CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300). * CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301). * CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302). * CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303). * CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304). * CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling (bsc#1283831). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Micro 6.0 zypper in -t patch SUSE-SLE-Micro-6.0-943 ## Package List: * SUSE Linux Micro 6.0 (aarch64 s390x x86_64) * libsoup-debugsource-3.4.2-159998.1.1 * libsoup-3_0-0-3.4.2-159998.1.1 * libsoup-3_0-0-debuginfo-3.4.2-159998.1.1 ## References: * * * * * * * * * * * * * * * * * * * * * * * * * * * * * Attachment : None (type=text/html) (HTML attachment elided)

Attachment : None (type=text/html) (HTML attachment elided)

(HTML attachment elided)

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SUSE Releases Security Updates for libsoup and containerd Vulnerabilities SUSE has issued security updates addressing multiple vulnerabilities in libsoup and containerd. The libsoup update (SUSE-SU-2026:24368-1) fixes 14 CVEs, including several rated as high severity, with CVSS scores up to 9.8. The containerd update (SUSE-SU-2026:24381-1) addresses six vulnerabilities, with the highest CVSS score at 9.4. Affected systems include SUSE Linux Micro 6.1. The vulnerabilities could allow for denial of service conditions and memory exhaustion attacks. Users are urged to apply the updates to mitigate potential exploitation. The updates were released on October 21 and October 23, 2026, respectively. 7 sources 71

Extracted Entities

SUSE alert SUSE-SU-2026:24368-1 (libsoup)

The full story

Extracted Entities

CVEs (15)

CWE Weaknesses (3)

Platforms (1)