CVE-2026-77680 - Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix
Brief
CVE ID : CVE-2026-77680
Published : Aug. 25, 2026, 8:36 p. m.
- 36 minutes ago
Description : An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix.
CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers. c, but the coalescing loop still removes merged ranges using g_array_remove_index() for each coalesced element.
Because GArray is contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N²) work coalescing them into a single range.