Back Linuxsecurity Ubuntu libsoup Update Fixes a Memory Leak in the Cookie Jar
Critical WordPress Flaw Exploited in the Wild: Learn how to protect your site and check your core update window. ×
USN-8890-1 introduced a regression in libsoup Software Description: - libsoup3: HTTP client/server library for GNOME Details: USN-8890-1 fixed vulnerabilities in libsoup. Unfortunately, that update introduced a memory leak in the cookie jar and could introduce a regression. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-4271) It was discovered that libsoup incorrectly handled certain HTTPS proxy connections. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-5119) It was discovered that libsoup incorrectly parsed certain chunked HTTP requests. A remote attacker could pos... Read the Full Advisory
USN-8890-1 introduced a regression in libsoup
Software Description:
- libsoup3: HTTP client/server library for GNOME
USN-8890-1 fixed vulnerabilities in libsoup. Unfortunately, that update
introduced a memory leak in the cookie jar and could introduce a
regression. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that libsoup incorrectly handled certain HTTP/2
requests. A remote attacker could possibly use this issue to cause a
denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu
26.04 LTS. (CVE-2026-4271)
It was discovered that libsoup incorrectly handled certain HTTPS proxy
connections. A remote attacker could possibly use this issue to obtain
sensitive information. This issue only affected Ubuntu 22.04 LTS, Ubuntu
24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-5119)
It was discovered that libsoup incorrectly parsed certain chunked HTTP
requests. A remote attacker could pos...
The problem can be corrected by updating your system to the following package versions: Ubuntu 26.10 gir1.2-soup-3.0 3.6.6-1ubuntu3.2 libsoup-3.0-0 3.6.6-1ubuntu3.2 libsoup-3.0-common 3.6.6-1ubuntu3.2 libsoup-3.0-dev 3.6.6-1ubuntu3.2 Ubuntu 26.04 LTS gir1.2-soup-3.0 3.6.6-1ubuntu0.3 libsoup-3.0-0 3.6.6-1ubuntu0.3 libsoup-3.0-common 3.6.6-1ubuntu0.3 libsoup-3.0-dev 3.6.6-1ubuntu0.3 Ubuntu 24.04 LTS gir1.2-soup-3.0 3.4.4-5ubuntu0.11 libsoup-3.0-0 3.4.4-5ubuntu0.11 libsoup-3.0-common 3.4.4-5ubuntu0.11 libsoup-3.0-dev 3.4.4-5ubuntu0.11 In general, a standard system update will make all the necessary changes.
Ubuntu Security Notice USN-8890-3
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
