CVE-2026-77014

Name of the Vulnerable Software and Affected Versions libsoup (affected versions not specified)

Description An issue exists in the SoupServer HTTP Range header processing. The sort ranges() function in soup-message-headers.c truncates a 64-bit subtraction result to a 32-bit integer, which flips the sign when range offsets differ by more than INT MAX. This leads to the silent omission of requested byte ranges from HTTP 206 Partial Content responses when handling resources larger than approximately 2 GB.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.