CVE-2026-77680

Received Received - Intake

Algorithm Complexity Flaw in libsoup Range Header Processing

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: redhat-SADP

Description

An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N²) work coalescing them into a single range. The vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required. The number of ranges is bounded only by the maximum request header size (~100 KiB), allowing roughly 25,000 ranges per request. Reporter measurements on libsoup HEAD containing the CVE-2025-32907 fix show ~90 ms single-core CPU per such request at the wire maximum, blocking the server's event loop for that duration. This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs. Affected: libsoup versions containing the CVE-2025-32907 fix but not merge request !550. Fixed upstream: MR !550 merged 2026-08-20, replacing per-element removal with O(N) in-place compaction and rejecting Range headers requesting more than 200 ranges. Upstream report: https://gitlab.gnome.org/GNOME/libsoup/-/issues/538 Related: CVE-2025-32907

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-25

Generated

2026-08-26

AI Q&A

2026-08-26

EPSS Evaluated

N/A

NVD

CVE-2026-77680

Affected Vendors & Products

Vendor	Product	Version / Range
gnome	libsoup	From 3.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

This is a CPU exhaustion vulnerability in libsoup's HTTP Range header processing. It occurs when a client sends many identical satisfiable ranges in a single Range header, causing an O(N²) algorithmic complexity flaw during range coalescing. The issue persists even after the CVE-2025-32907 fix due to inefficient array removal operations.

Detection Guidance

This vulnerability is specific to libsoup's HTTP Range header processing and may not have direct detection commands. Monitor for unusually high CPU usage during HTTP requests with Range headers. Check libsoup version and look for requests with excessive range values in server logs.

Impact Analysis

This vulnerability can cause server-side CPU exhaustion, blocking the event loop for up to 90 ms per request at maximum header size. It does not require authentication and can be triggered by sending requests with thousands of identical range headers, potentially leading to denial-of-service conditions.

Mitigation Strategies

Upgrade libsoup to a version containing MR !550 or later. If upgrading is not possible, limit the number of ranges in Range headers to 200 or less. Monitor server CPU usage and block requests with excessive ranges at the network level.

Hi! I’m here to help you understand CVE-2026-77680. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70