Ubuntu notice USN-8975-1 covers ten vulnerabilities in libsoup
- Severity
- Medium
- Sources
- 1
What happened
USN-8975-1 addresses ten libsoup flaws: CVE-2026-12478, CVE-2026-102555, CVE-2026-102556, CVE-2026-102557, CVE-2026-102558, CVE-2026-102559, CVE-2026-102560, CVE-2026-103399, CVE-2026-12547 and CVE-2026-12548. They cover WebSocket frame, message, fragmentation and compression handling, data URI handling, multipart messages, proxy credential handling and HTTP request handling, which allows arbitrary HTTP request injection in CVE-2026-103399. Impacts range from application crashes to information disclosure, and some CVEs are limited to Ubuntu 18.04 through 26.10. The notice gives no CVSS scores or fixed package versions, so defenders should apply the Ubuntu libsoup updates on affected releases.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Check whether your systems run libsoup on the affected Ubuntu releases.
- Apply the Ubuntu security update for libsoup on affected systems.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Products