CVE-2026-77014 in Red Hat
Summary
by MITRE • 08/20/2026
A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in libsoup stems from a critical integer overflow issue within the SoupServer component, specifically located in the sort_ranges comparator function found in soup-message-headers.c. This flaw manifests when processing HTTP Range headers for large files or data streams exceeding two gigabytes. The core technical defect involves the truncation of a 64-bit subtraction result down to a signed 32-bit integer during range calculation. In systems where byte offsets differ by more than INT_MAX, this arithmetic operation causes an overflow that flips the sign bit of the resulting value. Consequently, valid positive ranges are incorrectly interpreted as negative or invalid values, leading the server logic to silently omit these requested byte ranges from HTTP 206 Partial Content responses rather than returning them correctly or raising a standard error code for malformed requests.
From an operational perspective, this vulnerability significantly impacts applications relying on partial content delivery for large files, such as video streaming services, download managers, and backup systems that utilize resume capabilities. Clients requesting specific byte ranges of resources larger than approximately two gigabytes will receive incomplete data sets without explicit notification of the failure. This silent omission can lead to corrupted file downloads, interrupted media playback, or failed synchronization processes depending on how strictly the client application validates response integrity. The lack of an error code means debugging such issues is difficult for developers and users alike, as the HTTP status code remains 206 Partial Content despite the content being incomplete relative to the request scope.
This flaw aligns with CWE-190 Integer Overflow or Wraparound, which describes situations where arithmetic operations exceed the maximum value that can be stored in a variable type, leading to unexpected behavior such as sign flipping. Additionally, it relates to CWE-20 Improper Input Validation because the server fails to correctly validate and process valid range requests due to internal calculation errors rather than rejecting them outright. In terms of attack vectors, this vulnerability does not directly allow for remote code execution or denial-of-service in the traditional sense but can be exploited to cause data integrity issues or facilitate information disclosure if an attacker can predict file sizes and manipulate clients into requesting specific ranges that trigger the overflow condition. It falls under MITRE ATT&CK technique T1074 Data Staged, as it affects the reliable staging of large files over a network by corrupting the transfer mechanism at the protocol level.
Mitigation strategies for this vulnerability primarily involve upgrading to patched versions of libsoup where the integer truncation issue has been resolved through proper use of 64-bit arithmetic types throughout the range calculation process. Developers integrating libsoup should ensure their build environments are updated with the latest security patches provided by upstream maintainers. For applications handling large files, implementing client-side validation that verifies the total size of received data against the requested range can help detect such silent failures and trigger retransmission attempts. Furthermore, server administrators should monitor logs for unusual patterns in HTTP 206 responses associated with large resource IDs to identify potential exploitation or widespread impact within their infrastructure until patches are applied.