Red HatCVE-2026-77014
A flaw was found in libsoup's SoupServer HTTP Range header processing
Medium5.3CVE-2026-77014 · Published Aug 20, 2026 · updated Aug 25, 2026
A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 10 Product | all versions | No fix yet |
| Red Hat Enterprise Linux 6 Product | all versions | No fix yet |
| Red Hat Enterprise Linux 7 Product | all versions | No fix yet |
| all versions | No fix yet | |
| Red Hat Enterprise Linux 8 Product | all versions | No fix yet |
| all versions | No fix yet | |
| Red Hat Enterprise Linux 9 Product | all versions | No fix yet |
| all versions | No fix yet | |
| Red Hat OpenShift Container Platform 4 Product | all versions | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-197
More Red Hat advisories
All Red Hat| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 20 | Red Hat multicloud-operators-subscription: information disclosure | High7.7 | No fix yet |
| Aug 20 | A flaw was found in the multicloud-operators-subscription component | Critical9.9 | No fix yet |
| Aug 20 | Red Hat Advanced Cluster Management for Kubernetes 2: information disclosure | Low2.5 | No fix yet |
| Aug 20 | Red Hat lighthouse: information disclosure | Medium5.4 | No fix yet |
| Aug 20 | Red Hat Lighthouse. A remote attacker: privilege escalation | Low3.7 | No fix yet |
| Aug 20 | A flaw was found in Kata Containers | High8.1 | No fix yet |