CVE-2026-77680

Name of the Vulnerable Software and Affected Versions libsoup versions containing the CVE-2025-32907 fix but not merge request !550

Description An algorithmic complexity flaw exists in the processing of HTTP Range headers. The issue occurs within the soup message headers get ranges internal() function in libsoup/soup-message-headers.c, where a coalescing loop uses g array remove index() to remove merged ranges. Since GArray is contiguous, each removal triggers an O(N) memmove operation, resulting in O(N²) work when a large number of identical satisfiable ranges are provided. This path is reachable server-side via the handle partial get() function in libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required to trigger this behavior. This flaw leads to CPU exhaustion and availability issues by blocking the server's event loop, but it does not cause memory corruption or information disclosure.

Recommendations Update libsoup to the version incorporating merge request !550. As a temporary mitigation, restrict the use of the handle partial get() function or limit the size and number of Range headers accepted by the server.