Ubuntu fixes 11 vulnerabilities in libsoup: crash and proxy credential theft
USN-8975-1 of 3 November 2026 patches 11 CVEs in libsoup2.4 and libsoup3: WebSocket overflow, data URI, proxy credentials.
UptimeMag editorial team · 4 November 2026 · 2 min read
Ubuntu released security notice USN-8975-1 on 3 November 2026, patching 11 vulnerabilities in the libsoup library, used by GNOME applications and various HTTP client/server services on Linux. Anyone running GNOME desktop or services relying on libsoup2.4/libsoup3 on a machine exposed to the network has reason to update immediately.
What the notice fixes
Most of the flaws relate to WebSocket frame handling: it was discovered that libsoup incorrectly handled certain WebSocket frames, and a remote attacker could exploit this to crash an application or expose sensitive information (CVE-2026-12478). Related bugs involve fragmented, large or compressed WebSocket messages (CVE-2026-102557, CVE-2026-102559, CVE-2026-102560).
Two flaws warrant specific attention on an exposed server: libsoup did not correctly handle certain HTTP requests, and a remote attacker could use this issue to inject arbitrary HTTP requests (CVE-2026-103399). Additionally: libsoup incorrectly managed proxy credentials, and a remote attacker could exploit this to obtain sensitive information (CVE-2026-12547).
Research from third-party sources confirms that the same WebSocket bug line in libsoup was patched in parallel across other distributions: AlmaLinux, Rocky Linux and openSUSE released similar notices between mid-October and early November 2026, indicating a coordinated upstream intervention on the GNOME project.
Patched packages and versions
| Release | Key package | Patched version |
|---|---|---|
| 26.10 | libsoup-3.0-0 | 3.6.6-1ubuntu3.1 |
| 24.04 LTS | libsoup-2.4-1 | 2.74.3-6ubuntu1.10 |
| 22.04 LTS | libsoup2.4-1 | 2.74.2-3ubuntu0.10 |
| 20.04 LTS | libsoup2.4-1 | 2.70.0-1ubuntu0.5+esm5 (requires Ubuntu Pro) |
| 18.04 LTS | libsoup2.4-1 | 2.62.1-1ubuntu0.4+esm10 (requires Ubuntu Pro) |
| 16.04 LTS | libsoup2.4-1 | 2.52.2-1ubuntu0.3+esm9 (requires Legacy Support add-on) |
On 26.04 LTS and 22.04 LTS some sub-packages (gir1.2-soup-2.4, libsoup-gnome2.4) are only patched through Ubuntu Pro via ESM Apps, whilst the main libsoup-3.0 packages remain updatable without subscription.
What to do
On systems with standard repositories, a simple apt update && apt upgrade suffices. Those running 16.04, 18.04 or 20.04 without active Ubuntu Pro remain exposed to the listed flaws: the subscription is free for up to five machines, according to the notice itself.
Written with the help of artificial intelligence and checked by the editors (EU AI Act, art. 50).