This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-77014 →

DEBIAN-CVE-2026-77014

A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtr...

Original description

The description as published by the source.

A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.

Source: OSV.dev (Open Source Vulnerabilities) OSV