CVE-2026-12549: GNOME libsoup Range Request Regression Leading to DoS and Log Flooding

Technical summary

CVE-2026-12549 is a logic error in Range request processing affecting GNOME libsoup and Red Hat Enterprise Linux systems. The vulnerability stems from a regression introduced when a prior overflow check (originally fixed in CVE-2026-2443) was replaced with a generic signed comparison operation. When a client sends a Range header with a suffix-byte-range-spec (e.g., 'Range: bytes=-X') where X exceeds the total content length, the start position calculation produces a negative value that is not properly clamped to valid boundaries. This results in out-of-bounds memory references during response construction, malformed HTTP 206 responses, and log flooding as the server repeatedly attempts to process invalid ranges. The issue is classified as CWE-805 (Buffer Access with Incorrect Length Value).

Business impact

The vulnerability creates two distinct operational risks. First, attackers can trigger HTTP 206 responses with incorrect Content-Range headers, potentially confusing clients, breaking range-request-dependent workflows (such as video streaming or large file downloads), and degrading user experience. Second, sustained log flooding from repeated malformed requests can exhaust disk I/O and degrade system performance, creating a low-effort denial-of-service vector. Organizations running GNOME libsoup or affected RHEL versions as web servers or backend services should assess exposure to unauthenticated remote clients.

Affected systems

The vulnerability affects GNOME libsoup and Red Hat Enterprise Linux across multiple versions. Verification of specific RHEL version applicability and libsoup release ranges requires cross-reference with Red Hat's advisory. Any deployment using libsoup as an HTTP server component or embedded in a service handling client Range requests is in scope.

Exploitability

Exploitation requires network access and no authentication; however, the CVSS 3.1 score of 4.8 reflects medium severity because the attack complexity is rated high—the attacker must craft specific Range header values and the impact is limited to information disclosure (incorrect Content-Range data) and availability (log flooding). This is not a remote code execution vulnerability. Proof-of-concept exploitation is straightforward (sending a crafted Range header), but widespread automated attacks are unlikely without active exploitation code circulating.

Remediation

Organizations should apply vendor security patches as soon as they become available. Red Hat will release updated RHEL packages and GNOME will release patched libsoup versions. The fix restores proper bounds checking to ensure negative start values are clamped to valid offsets (typically 0 or the content size boundary). Until patches are deployed, consider implementing a Web Application Firewall (WAF) rule to reject Range requests where the suffix-byte-range-spec exceeds a reasonable threshold, though this is a temporary mitigation only.

Patch guidance

Monitor Red Hat and GNOME security advisories for patch releases addressing CVE-2026-12549. Apply patches to all systems running GNOME libsoup or affected RHEL versions. Test patches in a staging environment to confirm Range request handling returns to correct HTTP 206 responses with valid Content-Range headers. Verify log volume returns to baseline after patching to confirm the log flooding issue is resolved. Consider automated patch deployment if your environment supports it.

Detection guidance

In WAF or proxy logs, look for Range request headers with unusual suffix-byte-range values (e.g., 'Range: bytes=-999999999'). Monitor HTTP server error logs for repeated 206 responses with malformed or missing Content-Range headers. Track disk I/O and log file growth rates on systems running libsoup; a sudden spike in log volume may indicate active exploitation. Network-based detection: flag Range requests where the suffix value significantly exceeds the Content-Length of the response, or where responses indicate Content-Range with impossible values (e.g., start > end, or start < 0).

Why prioritize this

Assign this MEDIUM priority (CVSS 4.8) to your patching queue. While not critical, the combination of unauthenticated network access, relative ease of exploitation, and operational impact (log flooding, service disruption) warrants timely remediation. Prioritize systems exposed to untrusted clients (public-facing web services, CDNs, reverse proxies) and those with constrained disk or I/O capacity where log flooding poses immediate risk.

Risk score, explained

The CVSS 3.1 score of 4.8 reflects the vulnerability's unauthenticated network attack surface (AV:N) but is tempered by high attack complexity (AC:H), requiring crafted input. The impact scope is unchanged (S:U), with limited confidentiality impact from malformed headers (C:L) and availability impact from log flooding (A:L). The absence of integrity impact (I:N) and the lack of widespread automated exploitation context keep the score in the MEDIUM band rather than HIGH.

Frequently asked questions