CVE-2026-2443: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-2443 is an out-of-bounds read vulnerability in libsoup, a widely used HTTP client/server library in GNOME-based systems, specifically within the handle_partial_get() function. When processing HTTP Range headers, the library fails to properly validate the end value of the requested byte range against the total response size, potentially exposing heap memory beyond the intended response body. Affected software includes GNOME libsoup (unversioned CPE), Red Hat Enterprise Linux 6.0 through 10.0, and Microsoft Azure Linux 3 (azl3_libsoup packages). The vulnerability was published on February 13, 2026, with a CVSS v3.1 base score of 5.3 (Medium) (Red Hat Bugzilla, MSRC).

The root cause is an out-of-bounds read (CWE-125) in the handle_partial_get() function of libsoup, which processes HTTP Range headers for partial content responses. The end value of the requested byte range is not validated against the total response size; when GLib is compiled with G_DISABLE_CHECKS, the call to g_bytes_new_from_bytes() can create a memory slice that exceeds the bounds of the original buffer. A remote, unauthenticated attacker can send a specially crafted HTTP request with an oversized range value to a server using the embedded SoupServer component, causing heap memory beyond the intended response body to be returned. Exploitation is limited to servers using the embedded SoupServer and built with the vulnerable GLib configuration (Red Hat Bugzilla).

Successful exploitation allows a remote, unauthenticated attacker to read portions of server heap memory beyond the intended HTTP response, potentially disclosing sensitive data such as credentials, session tokens, or other confidential information resident in memory. The vulnerability has no integrity or availability impact, and its confidentiality impact is rated low. No user interaction or elevated privileges are required, making it accessible to any network-adjacent attacker with access to a vulnerable SoupServer instance (Red Hat Bugzilla, MSRC).

As of the available intelligence, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is approximately 0.098% (0.000980), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

1. Reconnaissance: Identify servers running applications that use the libsoup SoupServer component, particularly on GNOME-based Linux systems or Red Hat Enterprise Linux. Tools like Shodan or Censys can help locate internet-facing HTTP services.
2. Confirm vulnerable configuration: Determine whether the target libsoup build was compiled with GLib's G_DISABLE_CHECKS flag, which is required for the out-of-bounds condition to manifest in g_bytes_new_from_bytes().
3. Craft malicious HTTP Range header: Construct an HTTP GET request targeting a resource served by SoupServer, including a Range header with an end byte value that exceeds the actual size of the response body (e.g., Range: bytes=0-999999999).
4. Send request and capture response: Transmit the crafted request to the target server. If vulnerable, the server's response may include heap memory contents beyond the intended response body.
5. Analyze leaked memory: Inspect the over-read bytes in the response for sensitive data such as credentials, tokens, or other in-memory artifacts (Red Hat Bugzilla).

• Network: Unusual HTTP GET requests containing Range headers with abnormally large or out-of-bounds byte range values (e.g., Range: bytes=0-<very large number>) targeting SoupServer endpoints.
• Logs: Web server or application logs showing repeated partial content requests (HTTP 206 responses) with oversized range values from a single or small set of source IPs; unexpected large response sizes for partial content requests.
• Process: Anomalous memory usage or heap growth in processes embedding SoupServer following receipt of crafted Range header requests.

Apply available security patches for libsoup through the relevant distribution's security advisories — Red Hat has issued updates for RHEL 6.0, 7.0, 8.0, 9.0, and 10.0, and Microsoft has released patched Azure Linux 3 packages (azl3_libsoup_3.4.4-14). OpenSUSE Tumbleweed and SUSE users should apply updates referenced in the openSUSE security announcements. As a temporary workaround, restrict network access to servers running vulnerable SoupServer configurations and review HTTP server logs for suspicious Range header requests. Rebuilding libsoup without the G_DISABLE_CHECKS GLib flag eliminates the vulnerable code path (Red Hat Advisory, MSRC, Red Hat Bugzilla).

Coverage of CVE-2026-2443 has been primarily technical and distribution-focused, with security advisories issued by Red Hat, openSUSE, SUSE, and Microsoft for their respective platforms. German Linux security outlet pro-linux.de published multiple advisories covering libsoup vulnerabilities including this CVE. The Yocto Project security mailing list also discussed the issue in the context of embedded Linux builds. No notable researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking and patch notification channels.