Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix

Summary

CVE	CVE-2026-77680
State	PUBLISHED
Assigner	redhat
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-08-25 21:17:46 UTC
Updated	2026-08-25 21:17:46 UTC
Description	An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N²) work coalescing them into a single range. The vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required. The number of ranges is bounded only by the maximum request header size (~100 KiB), allowing roughly 25,000 ranges per request. Reporter measurements on libsoup HEAD containing the CVE-2025-32907 fix show ~90 ms single-core CPU per such request at the wire maximum, blocking the server's event loop for that duration. This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs. Affected: libsoup versions containing the CVE-2025-32907 fix but not merge request !550. Fixed upstream: MR !550 merged 2026-08-20, replacing per-element removal with O(N) in-place compaction and rejecting Range headers requesting more than 200 ranges. Upstream report: https://gitlab.gnome.org/GNOME/libsoup/-/issues/538 Related: CVE-2025-32907

Risk And Classification

Primary CVSS: v3.1 5.3 MEDIUM from [email protected]

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Problem Types: CWE-407 | CWE-407 Inefficient Algorithmic Complexity

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	5.3	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`
3.1	CNA	CVSS	5.3	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Red Hat	Red Hat Enterprise Linux 10	Not specified	Not specified

References

Reference	Source	Link	Tags
gitlab.gnome.org/GNOME/libsoup/-/merge_requests/550	[email protected]	gitlab.gnome.org
access.redhat.com/security/cve/CVE-2025-32907	[email protected]	access.redhat.com
bugzilla.redhat.com/show_bug.cgi	[email protected]	bugzilla.redhat.com
access.redhat.com/security/cve/CVE-2026-77680	[email protected]	access.redhat.com
gitlab.gnome.org/GNOME/libsoup/-/issues/538	[email protected]	gitlab.gnome.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Vendor Comments And Credit

Discovery Credit

CNA: Red Hat would like to thank Jianqiang (Stark) Li for reporting this issue. (en)

Additional Advisory Data

Source	Time	Event
CNA	2026-08-21T00:00:00.000Z	Reported to Red Hat.
CNA	2026-08-21T00:00:00.000Z	Made public.

Workarounds

CNA: Upgrade to a libsoup version containing merge request !550 (O(N) range coalescing and 200-range limit). Until patched, restrict network access to services using SoupServer, or terminate connections that send Range headers with excessive range counts.

There are currently no legacy QID mappings associated with this CVE.