CVE-2026-6324

A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soup_body_input_stream_read_chunked() function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.

Database specific

{
    "cna_assigner": "redhat",
    "cwe_ids": [
        "CWE-444"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6324.json"
}

References

Affected packages

Git / gitlab.gnome.org/gnome/libsoup

Affected ranges

Type

GIT

Repo

https://gitlab.gnome.org/gnome/libsoup

Events

Introduced

Fixed

96ac392b444d01bd5de1d1276b187c3ed49d048c

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "fixed": "96ac392b444d01bd5de1d1276b187c3ed49d048c"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

2.*

2.40.0

2.40.1

2.41.1

2.41.2

2.41.3

2.41.4

2.41.5

2.41.90

2.41.91

2.41.92

2.42.0

2.42.1

2.43.1

2.43.2

2.43.4

2.43.5

2.43.90

2.43.92

2.44.0

2.44.1

2.45.3

2.45.90

2.45.92

2.46.0

2.47.3

2.47.4

2.47.92

2.48.0

2.49.1

2.49.91

2.49.91.1

2.49.92

2.50.0

2.51.3

2.51.90

2.51.92

2.52.0

2.52.1

2.53.1

2.53.2

2.53.90

2.53.92

2.54.0

2.54.0.1

2.54.1

2.55.90

2.56.0

2.57.1

2.58.0

2.59.90

2.59.90.1

2.60.0

2.60.1

2.60.2

2.61.1

2.61.2

2.61.90

2.61.91

2.62.0

2.63.1

2.63.2

2.63.90

2.63.91

2.63.92

2.64.0

2.65.1

2.65.2

2.65.90

2.65.91

2.65.92

2.66.0

2.66.1

2.66.2

2.67.1

2.67.2

2.67.3

2.67.90

2.67.91

2.67.92

2.67.93

2.68.0

2.68.1

2.68.2

2.68.3

2.69.90

2.70.0

2.71.0

2.71.1

2.72.0

2.99.1

2.99.2

2.99.3

2.99.4

2.99.5

2.99.6

2.99.7

2.99.8

2.99.9

3.*

3.0.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.0.6

3.1.1

3.1.2

3.1.3

3.1.4

3.2.0

3.3.0

3.3.1

3.4.0

3.4.1

3.4.2

3.4.3

3.4.4

3.5.1

3.5.2

3.6.0

3.6.1

3.6.2

3.6.3

3.6.4

Other

LIBSOUP_1_99_15

LIBSOUP_1_99_16

LIBSOUP_1_99_17

LIBSOUP_1_99_19

LIBSOUP_1_99_20

LIBSOUP_1_99_22

LIBSOUP_1_99_23

LIBSOUP_1_99_24

LIBSOUP_1_99_25

LIBSOUP_2_1_10

LIBSOUP_2_1_11

LIBSOUP_2_1_12

LIBSOUP_2_1_13

LIBSOUP_2_1_2

LIBSOUP_2_1_3

LIBSOUP_2_1_4

LIBSOUP_2_1_5

LIBSOUP_2_1_6

LIBSOUP_2_1_7

LIBSOUP_2_1_8

LIBSOUP_2_1_9

LIBSOUP_2_23_1

LIBSOUP_2_23_6

LIBSOUP_2_23_91

LIBSOUP_2_23_92

LIBSOUP_2_24_0

LIBSOUP_2_25_1

LIBSOUP_2_25_2

LIBSOUP_2_25_4

LIBSOUP_2_25_5

LIBSOUP_2_25_91

LIBSOUP_2_26_0

LIBSOUP_2_26_0_9

LIBSOUP_2_26_1

LIBSOUP_2_27_1

LIBSOUP_2_27_2

LIBSOUP_2_27_4

LIBSOUP_2_27_5

LIBSOUP_2_27_90

LIBSOUP_2_27_91

LIBSOUP_2_27_92

LIBSOUP_2_28_0

LIBSOUP_2_28_1

LIBSOUP_2_29_3

LIBSOUP_2_29_5

LIBSOUP_2_29_6

LIBSOUP_2_29_90

LIBSOUP_2_29_91

LIBSOUP_2_2_0

LIBSOUP_2_2_100

LIBSOUP_2_2_101

LIBSOUP_2_2_102

LIBSOUP_2_2_103

LIBSOUP_2_2_5

LIBSOUP_2_2_6

LIBSOUP_2_2_6_1

LIBSOUP_2_2_90_NOT_A_REAL_RELEASE

LIBSOUP_2_2_91

LIBSOUP_2_2_92

LIBSOUP_2_2_93

LIBSOUP_2_2_94

LIBSOUP_2_2_95_1

LIBSOUP_2_2_96

LIBSOUP_2_2_97

LIBSOUP_2_2_98

LIBSOUP_2_2_99

LIBSOUP_2_30_0

LIBSOUP_2_31_6

LIBSOUP_2_31_90

LIBSOUP_2_31_92

LIBSOUP_2_32_0

LIBSOUP_2_32_1

LIBSOUP_2_32_2

LIBSOUP_2_33_4

LIBSOUP_2_33_5

LIBSOUP_2_33_6

LIBSOUP_2_33_90

LIBSOUP_2_33_92

LIBSOUP_2_34_0

LIBSOUP_2_34_1

LIBSOUP_2_35_3

LIBSOUP_2_35_4

LIBSOUP_2_35_90

LIBSOUP_2_35_92

LIBSOUP_2_36_0

LIBSOUP_2_37_1

LIBSOUP_2_37_2

LIBSOUP_2_37_3

LIBSOUP_2_37_4

LIBSOUP_2_37_5

LIBSOUP_2_37_90

LIBSOUP_2_37_91

LIBSOUP_2_37_92

LIBSOUP_2_38_0

LIBSOUP_2_38_1

LIBSOUP_2_39_1

LIBSOUP_2_39_2

LIBSOUP_2_39_3

LIBSOUP_2_39_4

LIBSOUP_2_39_4_1

LIBSOUP_2_39_5

LIBSOUP_2_39_90

LIBSOUP_2_39_91

LIBSOUP_2_39_92

LIBSOUP_2_3_0_1

LIBSOUP_2_3_2

LIBSOUP_2_3_4

LIBSOUP_2_40_0

LIBSOUP_2_40_1

LIBSOUP_2_41_1

LIBSOUP_2_41_2

LIBSOUP_2_41_3

LIBSOUP_2_41_4

LIBSOUP_2_41_5

LIBSOUP_2_41_90

LIBSOUP_2_41_91

LIBSOUP_2_41_92

LIBSOUP_2_42_0

LIBSOUP_2_42_1

LIBSOUP_2_43_1

LIBSOUP_2_43_2

LIBSOUP_2_43_4

LIBSOUP_2_43_5

LIBSOUP_2_43_90

LIBSOUP_2_43_92

LIBSOUP_2_4_0

LIBSOUP_2_4_1

SOUP_0_4

SOUP_0_4_1

SOUP_0_5

SOUP_0_6_0

SOUP_2_2_100

gnome-2-12-base

libsoup-2-0-branch-base

libsoup-hacking-branch-base

libsoup-pre214-branch-base

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-6324.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "5252250336448183672739009544446122612",
                "47907364192080274779293127694122589076",
                "133375317442185969931502807706135985494",
                "175862329446494456582280059914398120035",
                "147605455520277580544852683198114119207",
                "148127108298746976584161470866955906976",
                "263290651267915574195872356137598819245",
                "309683480584065641019334985150789171705",
                "114308541691089153301615615702886226628",
                "236426643327997479000716787083051449967",
                "171653896970795685301778783694829761356",
                "199659700376413812109101037316564262197"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-6324-32081c07",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://gitlab.gnome.org/gnome/libsoup@96ac392b444d01bd5de1d1276b187c3ed49d048c",
        "target": {
            "file": "libsoup/http1/soup-body-input-stream.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "132694437312584468251031477250602385056",
            "length": 1535
        },
        "id": "CVE-2026-6324-5c1572d6",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://gitlab.gnome.org/gnome/libsoup@96ac392b444d01bd5de1d1276b187c3ed49d048c",
        "target": {
            "file": "tests/server-test.c",
            "function": "do_chunked_test"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "7561991653851345159474377235049439384",
            "length": 2207
        },
        "id": "CVE-2026-6324-75230d3c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://gitlab.gnome.org/gnome/libsoup@96ac392b444d01bd5de1d1276b187c3ed49d048c",
        "target": {
            "file": "libsoup/http1/soup-body-input-stream.c",
            "function": "soup_body_input_stream_read_chunked"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "258306947550375934262994161502712549635",
            "length": 2495
        },
        "id": "CVE-2026-6324-90956a0b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://gitlab.gnome.org/gnome/libsoup@96ac392b444d01bd5de1d1276b187c3ed49d048c",
        "target": {
            "file": "libsoup/server/http1/soup-server-message-io-http1.c",
            "function": "io_read"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "45930873717169636658204096979150962525",
                "7312773875022908292158916186978614269",
                "177324389028524764656155744039164079936",
                "250990363521951772794602744394991888894",
                "228654950869699099096376923686403142322",
                "152239663951429721598511844396081711690",
                "106124983809417856846768884766915702304",
                "334793833705893232384300392390203713143",
                "44286936633756529144436884053692968363",
                "278263695436208923970806297840255183528",
                "60242522802375792421295462124568532918",
                "265694861892212701375920462599868092959",
                "282767195940321467425201447042658417431",
                "300341466339101772888927734682256239612",
                "262251369159393039608508543214959927308",
                "125523161000707065044902099259794580791",
                "64009524084699305816039632501165286126",
                "150278585487423823433348357236173414583",
                "334169748174899234780147483640508262912"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-6324-be0cdcb6",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://gitlab.gnome.org/gnome/libsoup@96ac392b444d01bd5de1d1276b187c3ed49d048c",
        "target": {
            "file": "tests/server-test.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "423701076298377116416838643283151378",
                "183956312383337804078925514345371204515",
                "89522295186761743914354865874967798199",
                "132005272742906472951300063787773458387",
                "139692967407537773883534435009953556333"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-6324-c53e0202",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://gitlab.gnome.org/gnome/libsoup@96ac392b444d01bd5de1d1276b187c3ed49d048c",
        "target": {
            "file": "libsoup/server/http1/soup-server-message-io-http1.c"
        }
    }
]

vanir_signatures_modified

"2026-11-07T19:04:03Z"