CVE-2026-77014: 
Podman vulnerability analysis and mitigation

CVE-2026-77014 is a numeric truncation vulnerability in libsoup's SoupServer HTTP Range header processing that causes silent omission of requested byte ranges from HTTP 206 Partial Content responses. The flaw exists in the sort_ranges() comparator function in soup-message-headers.c, which truncates a 64-bit subtraction result to a 32-bit integer, corrupting range sorting for resources larger than approximately 2 GB. It was reported by Zhengxiong Luo of the National University of Singapore, disclosed on August 20, 2026, and affects Red Hat products shipping libsoup and libsoup3 (specific fixed versions not yet published). It carries a CVSS v3.1 base score of 5.3 (Medium) (Red Hat Advisory, GitHub Advisory).

The root cause is CWE-197 (Numeric Truncation Error): the sort_ranges() comparator in soup-message-headers.c returns the difference of two goffset (64-bit) values cast to a 32-bit int. When two range start positions in a multi-range HTTP request differ by more than INT_MAX (~2.1 billion), the truncation flips the comparison sign, violating qsort's ordering contract. The mis-sorted ranges are then incorrectly merged, causing the server to silently omit one or more requested byte ranges from the HTTP 206 Partial Content response without any error indication to the client. Exploitation requires sending a crafted multi-range Range request header targeting a resource larger than ~2 GB, with range start offsets more than INT_MAX apart — no authentication is required. A fix is tracked in the GNOME libsoup merge request (Red Hat Bugzilla, GNOME GitLab MR).

Successful exploitation causes data integrity issues for clients consuming large resources (>2 GB) via HTTP Range requests: clients silently receive fewer byte ranges than requested with no error indication, leading to corrupted or incomplete data. Use cases particularly affected include resumable downloads, delta updates, mirror synchronization, and chunked verification of large objects. There is no confidentiality or availability impact; the vulnerability is limited to low integrity impact on the affected server's responses (Red Hat Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation as of the disclosure date (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.0023 (0.23%), indicating a low probability of exploitation in the near term. Exploitation is limited to scenarios where the target server hosts resources larger than ~2 GB and processes multi-range HTTP requests (Red Hat Advisory).

1. Reconnaissance: Identify HTTP servers using libsoup (e.g., GNOME-based applications, services on Red Hat Enterprise Linux) that serve static or dynamic resources larger than approximately 2 GB.
2. Craft multi-range request: Construct an HTTP request with a Range header specifying at least two byte ranges whose start offsets differ by more than INT_MAX (~2,147,483,647 bytes), e.g., Range: bytes=0-1023, 2147483648-2147484671.
3. Send request: Transmit the crafted request to the target SoupServer endpoint serving the large resource — no authentication is required.
4. Observe response: The server returns an HTTP 206 Partial Content response that silently omits one or more of the requested ranges due to the mis-sorted range merge, delivering incorrect or incomplete content to the client without any error signal (Red Hat Bugzilla, Red Hat Advisory).

• Network: HTTP requests containing Range headers with multiple byte ranges whose start offsets differ by more than ~2.1 GB (e.g., Range: bytes=0-N, 2147483648-M) targeting resources over 2 GB in size.
• Logs: Server access logs showing HTTP 206 responses to multi-range requests for large files, where the response body size is smaller than the sum of the requested ranges — indicating silent range omission.
• Application Behavior: Clients reporting incomplete or corrupted downloads of large files (>2 GB) when using HTTP range-based retrieval, with no accompanying HTTP error codes from the server (Red Hat Bugzilla).

A patch is available via the GNOME libsoup merge request (MR !550) and tracked in the GitHub Advisory GHSA-wmpg-2mpv-2hmm; organizations should update libsoup to a patched version once released by their distribution. Red Hat has stated no configuration-based mitigation is available for this vulnerability. As an operational workaround, consider implementing network controls or WAF rules to block or restrict multi-range HTTP Range requests to servers hosting resources larger than 2 GB until patching is complete (Red Hat Advisory, GitHub Advisory, GNOME GitLab MR).

Red Hat acknowledged the vulnerability and credited Zhengxiong Luo of the National University of Singapore for the report, noting that real-world impact is limited by the requirement for servers to host resources larger than ~2 GB (Red Hat Advisory). No significant broader community or social media discussion has been observed beyond standard vulnerability database aggregation as of the disclosure date.