USN-8890-2: Ubuntu extends libsoup patch to 26.10 covering eight CVEs

Canonical published USN-8890-2 on 21 October, extending the fix for eight libsoup3 vulnerabilities to Ubuntu 26.10 "Stonking Stingray" — the same corrections that were distributed on 6 October for other supported releases via USN-8890-1. The library handles HTTP/HTTPS connections for GNOME applications and services that depend on it, so the update primarily affects Ubuntu workstations and desktop environments rather than headless servers, which typically do not install it.

Ubuntu 26.10 was released on 15 October 2026, as confirmed by the official Canonical blog, so the -2 advisory arrives six days after the distribution release, bringing the new interim version into line with fixes already available for the LTS releases.

The fixed vulnerabilities

The most critical of the eight is CVE-2026-85197, a use-after-free flaw in libsoup's HTTP/2 client. According to the OpenCVE technical sheet, the issue scores 7.6 (High) on the CVSS 3.1 scale. The security bug logged on Debian describes the mechanism: it occurs when a GNOME application loads a file over HTTP/2 and the server sends a GOAWAY frame whilst the file body is being read asynchronously; the result can be memory corruption, leading to information disclosure or arbitrary code execution. Exploitation requires control of the target HTTP/2 server or a man-in-the-middle position.

The remaining seven involve denial-of-service attacks on HTTP/2 requests and transfers, bypass of security controls in HTTP chunked request parsing, information disclosure via HTTPS proxies or proxy authentication credentials, and DoS via malformed HTTP Range headers.

Packages and corrected version

Ubuntu Release	Package	Version
26.10 stonking	libsoup-3.0-0	3.6.6-1ubuntu3
26.10 stonking	libsoup-3.0-common	3.6.6-1ubuntu3
26.10 stonking	libsoup-3.0-dev	3.6.6-1ubuntu3
26.10 stonking	gir1.2-soup-3.0	3.6.6-1ubuntu3

For the other supported releases (16.04, 18.04, 20.04, 22.04, 24.04 and 26.04 LTS) the corrected versions remain those published on 6 October with USN-8890-1, partially available only through Ubuntu Pro ESM for the older versions.

What to do

On Ubuntu 26.10 a standard update is all that is needed: sudo apt update && sudo apt upgrade. A system reboot is not required, but GNOME applications that use libsoup (such as clients performing HTTP/2 uploads) should be restarted to load the updated library.