Cyber ·
USN-8890-2: libsoup vulnerabilities for Ubuntu 26.10
An Ubuntu Security notice, published on 21 October 2026, provides the libsoup3 update for Ubuntu 26.10. It complements USN-8890-1 and fixes flaws that may cause denial of service, information exposure, control bypass or code execution.
Notice USN-8890-2, published by the Ubuntu Security feed on 21 October 2026, provides the matching libsoup3 update for Ubuntu 26.10. It complements USN-8890-1, which had already fixed vulnerabilities in libsoup. According to the text, the flaws may cause denial of service, information exposure, control bypass or code execution. The listed items include problems in HTTP/2 requests (CVE-2026-4271), HTTPS proxy connections (CVE-2026-5119), chunked HTTP requests (CVE-2026-6324), proxy authentication credentials (CVE-2026-66339), HTTP Range headers (CVE-2026-77014 and CVE-2026-77680), HTTP/2 connections that may lead to code execution (CVE-2026-85197) and HTTP/2 transfers (CVE-2026-85534). For some items, the notice says only Ubuntu 22.04 LTS, 24.04 LTS or 26.04 LTS are affected; for others, the excerpt gives no such restriction. To consult the source, search for the identifier USN-8890-2 on Ubuntu Security and check the package and version list. Verification means comparing the installed libsoup3 version with the fixed version stated in the original notice. The source text is a machine translation, so in case of doubt the original English notice prevails.