Zero Radar
← feed
HighVulnerabilityCVE-2026-77014updated 27 Oct 2026, 10:17 UTC

libsoup web server drops requested byte ranges on files over 2 GB

A bug in the libsoup web library can make some download requests for very large files (over about 2 GB) return incomplete data without any error. This affects reliability and data correctness rather than letting attackers take over systems.

Fix availableOfficial, 3 sources
SeverityHighCVSS 5.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesUbuntu 26.10 libsoup3 updated via USN-8890-2. Other fixed versions: unknown from the provided material. · since 27 Oct 2026
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1Client requests rangeAsks for part of a large file
  2. 2SoupServer sorts rangesOffsets differ by over 2 GB
  3. 3Sign flips in 32-bit int64-bit result is truncated
  4. 4Ranges silently droppedResponse lacks requested bytes
  5. ResultClient receives incomplete data without error

What happened

In libsoup's SoupServer, the sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction to a 32-bit int, flipping the sign when range offsets differ by more than INT_MAX. Requested byte ranges are then silently omitted from HTTP 206 Partial Content responses.

Why it is dangerous: Clients requesting parts of large files can receive partial or wrong data with no error shown, which can corrupt downloads or break applications that rely on range requests. The risk is mainly to services that serve resources larger than about 2 GB.

Are you affected?

You are affected if you run an application using libsoup's SoupServer to serve HTTP Range requests on resources larger than approximately 2 GB.

libsoup (SoupServer, HTTP Range handling). Exact affected version numbers: unknown from the provided material. Ubuntu libsoup3 packages on Ubuntu 26.10 received updates via USN-8890-2.

What to do

  1. Install the libsoup updates from Ubuntu USN-8890-2 (libsoup3 on Ubuntu 26.10) or your distribution's equivalent
  2. Restart applications that use libsoup so the fixed library is loaded
  3. If you cannot update yet, avoid serving very large files (over 2 GB) through libsoup's SoupServer with range requests

Timeline

  1. 20 Aug 2026, 09:16 UTC
    Publicly disclosed
  2. 21 Oct 2026, 21:36 UTC
    Reported by Ubuntu USN · Ubuntu USN
  3. 27 Oct 2026, 10:13 UTC
    NVD reported on it · NVD
  4. 27 Oct 2026, 10:17 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 27 Oct 2026, 10:17 UTC
    Fix: Ubuntu 26.10 libsoup3 updated via USN-8890-2. Other fixed versions: unknown from the provided material.

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-77014 · GHSA-wmpg-2mpv-2hmm
CVSS
5.3 / 10
EPSS
0.2% chance of exploitation within 30 days
Disclosed
20 Aug 2026, 09:16 UTC
On Zero Radar
before the radar started
Last change
27 Oct 2026, 10:17 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

libsoup web server drops requested byte ranges on files over 2 GB · Zero Radar