Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. A flaw was found in libsoup's HTTP Range request handling in SoupServer. The fix for CVE-2025-32907 corrected range merge logic but left an O(N²) coalescing algorithm that removes merged ranges with g_array_remove_index(), causing quadratic CPU consumption when a client sends many identical satisfiable ranges in one Range header. An unauthenticated remote attacker can send a crafted HTTP GET with thousands of bytes=0-0 ranges to exhaust CPU on the server worker processing the request. Fixed upstream in merge request !550 (O(N) in-place merge plus 200-range cap).
*** Bug 2520148 has been marked as a duplicate of this bug. ***
*** Bug 2490533 has been marked as a duplicate of this bug. ***
FEDORA-2026-3f60ccf61f (libsoup3-3.6.6-10.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-3f60ccf61f
FEDORA-2026-ce24b84bb1 (libsoup3-3.7.2-2.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-ce24b84bb1
FEDORA-2026-fce2f41203 (libsoup3-3.6.6-5.fc43) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2026-fce2f41203
FEDORA-2026-3f60ccf61f has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-3f60ccf61f` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-3f60ccf61f See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-ce24b84bb1 has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-ce24b84bb1` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-ce24b84bb1 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-fce2f41203 has been pushed to the Fedora 43 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-fce2f41203` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-fce2f41203 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-3f60ccf61f (libsoup3-3.6.6-10.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2026-fce2f41203 (libsoup3-3.6.6-5.fc43) has been pushed to the Fedora 43 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2026-ce24b84bb1 (libsoup3-3.7.2-2.fc45) has been pushed to the Fedora 45 stable repository. If problem still persists, please make note of it in this bug report.