CVE-2026-2369: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-2369 is an integer underflow vulnerability in GNOME's libsoup HTTP client/server library that causes a buffer overread when processing content with a zero-length resource. The flaw was introduced by the fix for CVE-2025-32052 (commit a5b86bfc) in soup-content-sniffer.c, and was first reported on February 11, 2026. It affects GNOME libsoup (all versions incorporating the flawed CVE-2025-32052 patch) and Microsoft Azure Linux 3 packages azl3_libsoup_3.4.4-12 and azl3_libsoup_3.4.4-14. The CVSS v3.1 base score is 9.1 (Critical) per Feedly threat intelligence, though ENISA's EUVD rates it 6.5 (Medium) under a different scoring interpretation (Red Hat CVE, Red Hat Bugzilla, Microsoft MSRC).

The root cause is an integer underflow (CWE-191) introduced in the fix for CVE-2025-32052 within libsoup/soup-content-sniffer.c. The patch changed a loop condition from index_stream < resource_length to index_stream < resource_length - 1; when resource_length is 0 (i.e., MIN(512, 0) = 0), the subtraction of 1 from an unsigned gsize type wraps around to UINT_MAX, causing the condition 0 < UINT_MAX to evaluate as TRUE and the loop to execute on an empty buffer, resulting in a buffer overread. The proposed fix is to add a guard if (resource_length == 0) continue; before the has_ws path, consistent with the pattern already used in the else branch. The attack vector is network-based, requires no privileges, and no user interaction (Red Hat Bugzilla).

Successful exploitation can allow a remote, unauthenticated attacker to read memory beyond the intended buffer boundaries, potentially exposing sensitive information from application memory (high confidentiality impact). Additionally, triggering the buffer overread on a zero-length resource can cause an application-level denial of service by crashing the affected process (high availability impact). Integrity is not directly impacted. Any application using libsoup for HTTP parsing — including GNOME desktop components and server-side applications — is within scope (Red Hat CVE, Red Hat Bugzilla).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.037%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Despite the lack of active exploitation, the network-accessible, no-privilege-required attack vector warrants prompt patching.

1. Identify target: Locate a network-accessible service or application that uses a vulnerable version of libsoup for HTTP content sniffing (e.g., GNOME Web, GNOME Online Accounts, or custom applications using libsoup).
2. Craft malicious HTTP response: Prepare an HTTP response with a Content-Type that triggers the content-sniffing code path in sniff_unknown() within soup-content-sniffer.c, and set the response body to zero bytes (empty body, Content-Length: 0).
3. Trigger the underflow: Deliver the crafted response to the target application. When libsoup processes the zero-length resource, resource_length evaluates to 0, and resource_length - 1 underflows to UINT_MAX for the unsigned gsize type.
4. Buffer overread occurs: The loop condition 0 < UINT_MAX evaluates as TRUE, causing the loop to iterate over an empty buffer and read memory beyond its bounds.
5. Achieve objective: Depending on memory layout, the attacker may read sensitive data from adjacent memory regions (information disclosure) or cause the application to crash (denial of service) (Red Hat Bugzilla).

• Network: Unusual HTTP responses with zero-length bodies (Content-Length: 0) directed at libsoup-based clients; repeated connections from unexpected external hosts to GNOME or libsoup-using services.
• Logs: Application crash logs or core dumps from processes using libsoup (e.g., gnome-online-accounts, epiphany, custom apps); segmentation fault entries in system logs (/var/log/syslog, journalctl) referencing libsoup.
• Process: Unexpected termination or restart of GNOME services or applications that use libsoup for HTTP communication; increased frequency of application crashes following receipt of HTTP responses with empty bodies.

Patches are available from GNOME via the upstream issue tracker and from distribution maintainers. Microsoft Azure Linux 3 users should update libsoup beyond version 3.4.4-14. Linux distribution users (RHEL, SUSE, openSUSE Tumbleweed, Fedora, Yocto) should apply the security updates provided by their respective vendors as soon as available. As a code-level workaround, adding if (resource_length == 0) continue; before the has_ws path in soup-content-sniffer.c mitigates the underflow. Prioritize patching given the network-based, no-authentication-required attack vector (Red Hat Bugzilla, GNOME GitLab, Microsoft MSRC).

The vulnerability received coverage across Linux security news outlets including pro-linux.de and linuxsecurity.com, primarily in the context of distribution security advisories for SUSE, openSUSE, and Fedora. The Yocto Project security mailing list also tracked the issue across multiple messages. No notable individual researcher commentary or significant social media discussion beyond automated CVE tracking posts (e.g., Bluesky CVE feeds) has been identified (Feedly).