CVE-2026-66337

A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory.

A flaw was found in libsoup where an unsigned integer underflow in soup_filter_input_stream_read_until() causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can trigger this against any libsoup client using SoupMultipartInputStream by sending a crafted multipart response with a boundary string longer than the internal buffer. This can crash the client application or potentially disclose heap memory contents. This issue is related to but distinct from CVE-2026-1761.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.