# CVE-2026-66338: libsoup: Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-66338: A flaw w... CVE-2026-66338 is fixed in 10 products on 1 platform, first by ALAS2023-2026-3212, released November 7, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-66338 - Priority: High - CVSS: n/a (important) - EPSS: 0.0029 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Oct 12, 2026 ## Description Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-66338: A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests. CVE-2026-66337: A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory. CVE-2026-15714: An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists in the soup_multipart_input_stream_read_headers() function inside soup-multipart-input-stream.c, which does not adequately restrict or validate the size of incoming multipart boundary strings. When processing a crafted HTTP response containing a malformed or oversized boundary parameter, the internal stream reader reads past the allocated buffer bounds. A remote, unauthenticated attacker can exploit this behavior to cause a service denial (DoS) through application failure or potentially read fragments of unauthorized memory metadata. CVE-2026-103399: A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled request, leading to unintended request handling. CVE-2026-102560: A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow. CVE-2026-102559: A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow. CVE-2026-102558: A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data. CVE-2026-102557: A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash. CVE-2026-102556: A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | libsoup amzn 2023 | 2.72.0-6.amzn2023.0.16 | [ALAS2023-2026-3212](https://patchblox.com/security/data/fix/linux/alas2023-2026-3212.md) | Nov 7, 2026 | | Linux | libsoup-debuginfo amzn 2023 | 2.72.0-6.amzn2023.0.16 | [ALAS2023-2026-3212](https://patchblox.com/security/data/fix/linux/alas2023-2026-3212.md) | Nov 7, 2026 | | Linux | libsoup-debugsource amzn 2023 | 2.72.0-6.amzn2023.0.16 | [ALAS2023-2026-3212](https://patchblox.com/security/data/fix/linux/alas2023-2026-3212.md) | Nov 7, 2026 | | Linux | libsoup-devel amzn 2023 | 2.72.0-6.amzn2023.0.16 | [ALAS2023-2026-3212](https://patchblox.com/security/data/fix/linux/alas2023-2026-3212.md) | Nov 7, 2026 | | Linux | libsoup-doc amzn 2023 | 2.72.0-6.amzn2023.0.16 | [ALAS2023-2026-3212](https://patchblox.com/security/data/fix/linux/alas2023-2026-3212.md) | Nov 7, 2026 | | Linux | libsoup3 amzn 2023 | 3.7.3-1.amzn2023 | [ALAS2023-2026-3240](https://patchblox.com/security/data/fix/linux/alas2023-2026-3240.md) | Nov 7, 2026 | | Linux | libsoup3-debuginfo amzn 2023 | 3.7.3-1.amzn2023 | [ALAS2023-2026-3240](https://patchblox.com/security/data/fix/linux/alas2023-2026-3240.md) | Nov 7, 2026 | | Linux | libsoup3-debugsource amzn 2023 | 3.7.3-1.amzn2023 | [ALAS2023-2026-3240](https://patchblox.com/security/data/fix/linux/alas2023-2026-3240.md) | Nov 7, 2026 | | Linux | libsoup3-devel amzn 2023 | 3.7.3-1.amzn2023 | [ALAS2023-2026-3240](https://patchblox.com/security/data/fix/linux/alas2023-2026-3240.md) | Nov 7, 2026 | | Linux | libsoup3-doc amzn 2023 | 3.7.3-1.amzn2023 | [ALAS2023-2026-3240](https://patchblox.com/security/data/fix/linux/alas2023-2026-3240.md) | Nov 7, 2026 | --- Data as of 2026-11-10T13:56:55Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.