Algorithmic Complexity Vulnerability in Libsoup's HTTP Range Header Processing
CVE-2026-77680

5.3MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Vendor
CVE Published:
25 August 2026

What is CVE-2026-77680?

An algorithmic complexity flaw in libsoup's HTTP Range header processing can cause significant performance degradation under certain conditions. Although CVE-2025-32907 addressed memory amplification, a coalescing loop still poses risks when handling multiple identical range requests. No authentication is needed to exploit this vulnerability, which allows attackers to potentially exhaust CPU resources of the server by triggering a high number of range requests, leading to prolonged server response times. The upstream fix merges a more efficient coalescing approach while limiting the number of allowable ranges to prevent such issues.

References

https://access.redhat.com/security/cve/CVE-2025-32907
technical-descriptionx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-77680
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2520892
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Jianqiang (Stark) Li for reporting this issue.
.