by Kastro
Paper/Archive/CVE-2026-2369

CVE-2026-2369

Red Hat Red Hat Enterprise Linux 10 — Libsoup: libsoup: buffer overread due to integer underflow when handling zero-length resources

EPSS 0.4%CVSS 9.1
critical.is priorityof 100
35
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 37.0.370 × 207.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This can allow an attacker to potentially access sensitive information or cause an application level denial of service.

Affected

ProductAffectedFixed inSource
Red Hat Enterprise Linux 10see advisory–CNA
Red Hat Enterprise Linux 6see advisory–CNA
Red Hat Enterprise Linux 7see advisory–CNA
Red Hat Enterprise Linux 8see advisory–CNA
Red Hat Enterprise Linux 9see advisory–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
redhat (CNA)6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refaccess.redhat.com/security/cve/CVE-2026-2369refbugzilla.redhat.com/show_bug.cgi?id=2439091refgitlab.gnome.org/GNOME/libsoup/-/issues/498