This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-77014 →
UBUNTU-CVE-2026-77014
A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtr...
Original description
The description as published by the source.
A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:Pro:16.04:LTS
libsoup2.4
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.2-1ubuntu0.3+esm8"}]}]
Ubuntu:Pro:18.04:LTS
libsoup2.4
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.1-1ubuntu0.4+esm9"}]}]
Ubuntu:Pro:20.04:LTS
libsoup2.4
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.70.0-1ubuntu0.5+esm4"}]}]
Ubuntu:22.04:LTS
libsoup2.4
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-3ubuntu0.9"}]}]
Ubuntu:Pro:22.04:LTS
libsoup3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-0ubuntu1+esm9"}]}]
Ubuntu:24.04:LTS
libsoup2.4
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-6ubuntu1.9"}]}]
Ubuntu:24.04:LTS
libsoup3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-5ubuntu0.9"}]}]
Ubuntu:26.10
libsoup2.4
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10
libsoup3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.04:LTS
libsoup3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-1ubuntu0.1"}]}]
Ubuntu:Pro:26.04:LTS
libsoup2.4
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-10.1ubuntu5+esm3"}]}]
References
- advisory ubuntu.com
- report ubuntu.com
- report cve.org
- report gitlab.gnome.org
- report access.redhat.com
- report bugzilla.redhat.com