SoupServer HTTP Range Header Integer Overflow Leading to Partial Content Omission

Executive Summary

This vulnerability is an integer truncation flaw in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator incorrectly truncates a 64-bit subtraction result to 32-bit, causing sign flips for range offsets differing by more than INT_MAX. This leads to silent omission of requested byte ranges from HTTP 206 Partial Content responses for resources larger than approximately 2 GB.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect HTTP responses for resources larger than 2 GB. Check if the server returns fewer byte ranges than requested in multi-range requests. Monitor logs for HTTP 206 responses with missing ranges. Use tools like curl to send crafted Range headers and compare expected vs actual response sizes.

Useful 0 Not Useful 0

Impact Analysis

An unauthenticated remote attacker could exploit this by sending a crafted multi-range HTTP request for a large resource. This may cause clients to receive incomplete data without error, affecting resumable downloads, delta updates, mirror synchronization, or large object verification. Integrity of transferred data could be compromised.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts data integrity for large file transfers by causing servers to omit requested byte ranges without error. While not directly violating GDPR or HIPAA, it could lead to incomplete data transmission during downloads or updates, potentially compromising compliance with requirements for accurate data handling and integrity in regulated environments.

Useful 0 Not Useful 0

Mitigation Strategies

Apply patches from libsoup maintainers when available. Temporarily disable HTTP Range requests if not critical. Use a web application firewall to filter malformed Range headers. Monitor for unusual traffic patterns targeting large resources.

Useful 0 Not Useful 0