Home / mailings [USN-8780-1] libsoup vulnerabilities
Posted on 21 September 2026
Ubuntu Security==========================================================================Ubuntu Security Notice USN-8780-1
September 17, 2026
libsoup2.4, libsoup3 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in libsoup.
Software Description:
- libsoup2.4: HTTP client/server library for GNOME
- libsoup3: HTTP client/server library for GNOME
Details:
It was discovered that libsoup incorrectly handled certain URLs when
using an HTTP proxy. A remote attacker could possibly use this issue to
inject arbitrary HTTP headers. (CVE-2026-1467)
It was discovered that libsoup did not remove proxy authentication
credentials when following HTTP redirects. A remote attacker could
possibly use this issue to obtain sensitive information.
(CVE-2026-1539)
Ahmed Lekssays discovered that libsoup incorrectly parsed certain HTTP
requests. A remote attacker could possibly use this issue to obtain
sensitive information. (CVE-2026-1801)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 26.04 LTS
gir1.2-soup-2.4 2.74.3-10.1ubuntu5+esm2
Available with Ubuntu Pro
libsoup-2.4-1 2.74.3-10.1ubuntu5+esm2
Available with Ubuntu Pro
libsoup-gnome-2.4-1 2.74.3-10.1ubuntu5+esm2
Available with Ubuntu Pro
libsoup-gnome2.4-dev 2.74.3-10.1ubuntu5+esm2
Available with Ubuntu Pro
libsoup2.4-common 2.74.3-10.1ubuntu5+esm2
Available with Ubuntu Pro
libsoup2.4-dev 2.74.3-10.1ubuntu5+esm2
Available with Ubuntu Pro
Ubuntu 24.04 LTS
gir1.2-soup-2.4 2.74.3-6ubuntu1.8
gir1.2-soup-3.0 3.4.4-5ubuntu0.8
libsoup-2.4-1 2.74.3-6ubuntu1.8
libsoup-3.0-0 3.4.4-5ubuntu0.8
libsoup-3.0-common 3.4.4-5ubuntu0.8
libsoup-3.0-dev 3.4.4-5ubuntu0.8
libsoup-gnome-2.4-1 2.74.3-6ubuntu1.8
libsoup-gnome2.4-dev 2.74.3-6ubuntu1.8
libsoup2.4-common 2.74.3-6ubuntu1.8
libsoup2.4-dev 2.74.3-6ubuntu1.8
Ubuntu 22.04 LTS
gir1.2-soup-2.4 2.74.2-3ubuntu0.8
gir1.2-soup-3.0 3.0.7-0ubuntu1+esm8
Available with Ubuntu Pro
libsoup-3.0-0 3.0.7-0ubuntu1+esm8
Available with Ubuntu Pro
libsoup-3.0-common 3.0.7-0ubuntu1+esm8
Available with Ubuntu Pro
libsoup-3.0-dev 3.0.7-0ubuntu1+esm8
Available with Ubuntu Pro
libsoup-gnome2.4-1 2.74.2-3ubuntu0.8
libsoup-gnome2.4-dev 2.74.2-3ubuntu0.8
libsoup2.4-1 2.74.2-3ubuntu0.8
libsoup2.4-common 2.74.2-3ubuntu0.8
libsoup2.4-dev 2.74.2-3ubuntu0.8
Ubuntu 20.04 LTS
gir1.2-soup-2.4 2.70.0-1ubuntu0.5+esm3
Available with Ubuntu Pro
libsoup-gnome2.4-1 2.70.0-1ubuntu0.5+esm3
Available with Ubuntu Pro
libsoup-gnome2.4-dev 2.70.0-1ubuntu0.5+esm3
Available with Ubuntu Pro
libsoup2.4-1 2.70.0-1ubuntu0.5+esm3
Available with Ubuntu Pro
libsoup2.4-dev 2.70.0-1ubuntu0.5+esm3
Available with Ubuntu Pro
Ubuntu 18.04 LTS
gir1.2-soup-2.4 2.62.1-1ubuntu0.4+esm8
Available with Ubuntu Pro
libsoup-gnome2.4-1 2.62.1-1ubuntu0.4+esm8
Available with Ubuntu Pro
libsoup-gnome2.4-dev 2.62.1-1ubuntu0.4+esm8
Available with Ubuntu Pro
libsoup2.4-1 2.62.1-1ubuntu0.4+esm8
Available with Ubuntu Pro
libsoup2.4-dev 2.62.1-1ubuntu0.4+esm8
Available with Ubuntu Pro
Ubuntu 16.04 LTS
gir1.2-soup-2.4 2.52.2-1ubuntu0.3+esm7
Available with Ubuntu Pro
libsoup-gnome2.4-1 2.52.2-1ubuntu0.3+esm7
Available with Ubuntu Pro
libsoup-gnome2.4-dev 2.52.2-1ubuntu0.3+esm7
Available with Ubuntu Pro
libsoup2.4-1 2.52.2-1ubuntu0.3+esm7
Available with Ubuntu Pro
libsoup2.4-dev 2.52.2-1ubuntu0.3+esm7
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-8780-1
CVE-2026-1467, CVE-2026-1539, CVE-2026-1801
Package Information:
https://launchpad.net/ubuntu/+source/libsoup2.4/2.74.3-6ubuntu1.8
https://launchpad.net/ubuntu/+source/libsoup3/3.4.4-5ubuntu0.8
--===============5328180483942075622==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
