Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 412

Export CSV
CVE-2026-3632

Libsoup: libsoup: http smuggling and server-side request forgery via malformed hostnames

A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not properly validate hostnames, allowing special characters to be injected into HTTP headers. A remote attacker could exploit this to perform HTTP smuggling, where they can send hidden, malicious requests alongside legitimate ones. In certain situations, this could lead to Server-Side Request Forgery (SSRF), enabling an attacker to force the server to make unauthorized requests to other internal or external systems. The impact is low, as SoupServer is not actually used in internet infrastructure.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed
Vendors
Gnome Libsoup Redhat
Products
Libsoup Libsoup Enterprise Linux and 1 more
CVE-2026-2708

Libsoup: libsoup: http request smuggling via duplicate content-length headers

A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Gnome Libsoup Redhat
Products
Libsoup Libsoup Enterprise Linux and 1 more
CVE-2026-2443

Libsoup: out-of-bounds read in libsoup handle_partial_get() leading to heap information disclosure

A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access portions of server memory beyond the intended response. Exploitation requires a vulnerable configuration and access to a server using the embedded SoupServer component.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gnome Red Hat Redhat
Products
Libsoup Enterprise Linux Enterprise Linux and 1 more
CVE-2026-1801

Libsoup: libsoup: http request smuggling via malformed chunk headers

A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or user interaction by sending specially crafted chunked requests. This allows libsoup to parse and process multiple HTTP requests from a single network message, potentially leading to information disclosure.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gnome Redhat
Products
Libsoup Enterprise Linux Rhel Els
CVE-2025-6199

Gdk-pixbuf: uninitialized memory disclosure in gdkpixbuf gif lzw decoder

A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output size to the full buffer length rather than the actual number of written bytes. This logic error results in uninitialized sections of the buffer being included in the output, potentially leaking arbitrary memory contents in the processed image.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Gnome Redhat
Products
Gdkpixbuf Enterprise Linux Rhel Els
CVE-2026-118475

Eog: eye of gnome: buffer overrun when parsing malicious png files with non-standard iccp chunk

A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the application fails to validate chunk boundaries while searching for a null terminator. An attacker could trick a user into opening a malicious image, causing the application to read past the allocated buffer. This issue can lead to an application crash, resulting in a Denial of Service (DoS), or potentially expose sensitive memory contents.

CVSS 3.1 · 3.6 Low EPSS < 1% KEV · Not listed
Vendors
Gnome Red Hat Redhat
Products
Eog Enterprise Linux Enterprise Linux and 1 more
CVE-2026-10028

Glib-networking: infinite loop in glib-networking gnutls backend allows remote denial of service via circular certificate chain

A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by presenting a specially crafted certificate chain to an application that uses glib-networking with the GnuTLS backend enabled and performs certificate verification. This crafted chain, which contains circular issuer relationships, can cause an infinite loop during certificate verification. The unbounded traversal consumes excessive CPU resources, leading to a denial of service for the affected process or worker.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gnome Redhat
Products
Glib-networking Enterprise Linux Rhel Els
CVE-2025-4056

Glib: glib crash after long command line

A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Gnome Microsoft Redhat
Products
Glib Windows Enterprise Linux and 1 more
CVE-2026-118599

epiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension install

A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi. This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143). Requirements: the victim must install or open a malicious WebExtension (.xpi). Affected: Epiphany >= 47.0 (WebExtension XPI install path). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter acknowledgment: Fernando Munoz

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gnome
Products
Epiphany
CVE-2026-85534

Libsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body read

A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGS_INITIAL_WINDOW_SIZE while that buffered read is still in progress. The client then copies the full buffer into a smaller DATA callback without a runtime bounds check, which can abort the process or fail the HTTP/2 session.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Gnome Redhat
Products
Libsoup Enterprise Linux Rhel Els
CVE-2026-81893

Gdk-pixbuf: gdk-pixbuf: invalid write in jpeg icc profile parser on error recovery

A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent allocation in the same decode can cause an out-of-bounds write, potentially crashing the application. To exploit this flaw, an application using gdk-pixbuf must process the malicious JPEG image. Affected version >= 2.26.4

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Gnome Redhat
Products
Gdk-pixbuf Enterprise Linux Rhel Els
CVE-2026-79902

Gimp: stack vla size underflow denial of service in seattle

A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array (VLA) on the stack without integer overflow checks, causing an unbounded stack allocation. This issue leads to an application crash, resulting in a denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gimp Gnome Redhat
Products
Gimp Gimp Enterprise Linux and 1 more
CVE-2026-66339

Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gnome Libsoup Redhat
Products
Libsoup Libsoup Enterprise Linux and 1 more
CVE-2026-59089

Gimp: gimp: denial of service via integer overflow in playstation tim loader

A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calculates the size of the Color Look-Up Table (CLUT) due to an integer overflow. This occurs when multiplying num_colors and num_cluts, both 16-bit unsigned short integers, resulting in a value exceeding the maximum integer limit. An attacker could exploit this by providing a specially crafted image file, leading to undefined behavior and causing the GIMP plug-in to abort, effectively resulting in a denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gimp Gnome Redhat
Products
Gimp Gimp Enterprise Linux and 1 more
CVE-2026-58380

Gimp: gimp: stack buffer overflow in pnmscanner_gettoken()

A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Gimp Gnome Redhat
Products
Gimp Gimp Enterprise Linux and 3 more
CVE-2026-66337

Libsoup: libsoup: heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()

A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gnome Libsoup Redhat
Products
Libsoup Libsoup Enterprise Linux and 1 more
CVE-2026-6324

Libsoup: libsoup: http request smuggling via unsigned to signed conversion error

A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the `soup_body_input_stream_read_chunked()` function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.

CVSS 3.1 · 4.8 Medium EPSS 1.3% KEV · Not listed
Vendors
Gnome Redhat
Products
Libsoup Enterprise Linux Rhel Els
CVE-2026-4271

Libsoup: libsoup: denial of service via use-after-free in http/2 server

A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by sending specially crafted HTTP/2 requests that cause authentication failures. This can lead to the application attempting to access memory that has already been freed, potentially causing application instability or crashes, resulting in a Denial of Service (DoS).

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gnome Redhat
Products
Libsoup Enterprise Linux Enterprise Linux Eus and 1 more
CVE-2026-5119

Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Gnome Redhat
Products
Libsoup Enterprise Linux Enterprise Linux Eus and 6 more
CVE-2026-4887

Gimp: gimp:memory disclosure and denial of service via specially crafted pcx image

A flaw was found in GIMP. This issue is a heap buffer over-read in GIMP PCX file loader due to an off-by-one error. A remote attacker could exploit this by convincing a user to open a specially crafted PCX image. Successful exploitation could lead to out-of-bounds memory disclosure and a possible application crash, resulting in a Denial of Service (DoS).

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Gimp Gnome Redhat
Products
Gimp Gimp Enterprise Linux and 6 more