USN-8975-1

    Dashboard / Vulnerabilities / USN-8975-1

    USN-8975-1

    Published: 3 Nov 2026Last Modified: 4 Nov 2026

    Summary: libsoup2.4, libsoup3 vulnerabilities

    Details: It was discovered that libsoup incorrectly handled certain WebSocket frames. A remote attacker could possibly use this issue to cause an application to crash or expose sensitive information. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-12478) It was discovered that libsoup incorrectly handled certain data URIs. A remote attacker could possibly use this issue to cause an application to crash or expose sensitive information. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-102555) It was discovered that libsoup incorrectly handled certain WebSocket messages. A remote attacker could possibly use this issue to cause an application to crash. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-102556) It was discovered that libsoup incorrectly handled fragmented WebSocket messages. A remote attacker could possibly use this issue to cause an application to crash. (CVE-2026-102557) It was discovered that libsoup incorrectly handled certain WebSocket frames. A remote attacker could possibly use this issue to cause an application to crash. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-102558) It was discovered that libsoup incorrectly handled large WebSocket messages. An attacker could possibly use this issue to cause an application to crash. (CVE-2026-102559) It was discovered that libsoup incorrectly handled compressed WebSocket messages. An attacker could possibly use this issue to cause an application to crash. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-102560) It was discovered that libsoup did not properly handle certain HTTP requests. A remote attacker could possibly use this issue to inject arbitrary HTTP requests. (CVE-2026-103399) It was discovered that libsoup incorrectly handled proxy credentials. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-12547) It was discovered that libsoup incorrectly handled multipart messages. A remote attacker could possibly use this issue to cause an application to crash or obtain sensitive information. (CVE-2026-12548)

    References: https://ubuntu.com/security/notices/USN-8975-1, https://ubuntu.com/security/CVE-2026-12478, https://ubuntu.com/security/CVE-2026-12547, https://ubuntu.com/security/CVE-2026-12548, https://ubuntu.com/security/CVE-2026-102555, https://ubuntu.com/security/CVE-2026-102556, https://ubuntu.com/security/CVE-2026-102557, https://ubuntu.com/security/CVE-2026-102558, https://ubuntu.com/security/CVE-2026-102559, https://ubuntu.com/security/CVE-2026-102560, https://ubuntu.com/security/CVE-2026-103399

    Affected packages

    Package

    Name: libsoup2.4

    Purl: pkg:deb/ubuntu/libsoup2.4?arch=source&distro=esm-infra-legacy%2Fxenial

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.52.2-1ubuntu0.3+esm9

    Affected versions

    2.50.0-2debian1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    USN-8975-1 | CVE-DB