Algorithmic Complexity Affecting libsoup2.4 package, versions *
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-ECHOLATEST-LIBSOUP24-19267889
- published26 Aug 2026
- disclosed25 Aug 2026
Introduced: 25 Aug 2026
NewCVE-2026-77680 (opens in a new tab)How to fix?
There is no fixed version for Echo:latest libsoup2.4.
NVD Description
Note: Versions mentioned in the description apply only to the upstream libsoup2.4 package and not the libsoup2.4 package as distributed by Echo.
See How to fix? for Echo:latest relevant fixed versions and status.
An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix.
CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N²) work coalescing them into a single range.
The vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required. The number of ranges is bounded only by the maximum request header size (~100 KiB), allowing roughly 25,000 ranges per request. Reporter measurements on libsoup HEAD containing the CVE-2025-32907 fix show ~90 ms single-core CPU per such request at the wire maximum, blocking the server's event loop for that duration.
This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs.
Affected: libsoup versions containing the CVE-2025-32907 fix but not merge request !550. Fixed upstream: MR !550 merged 2026-08-20, replacing per-element removal with O(N) in-place compaction and rejecting Range headers requesting more than 200 ranges. Upstream report: https://gitlab.gnome.org/GNOME/libsoup/-/issues/538 Related: CVE-2025-32907
References
- https://advisory.echohq.com/cve/CVE-2026-77680
- https://access.redhat.com/security/cve/CVE-2025-32907
- https://access.redhat.com/security/cve/CVE-2026-77680
- https://bugzilla.redhat.com/show_bug.cgi?id=2520892
- https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/550
- https://gitlab.gnome.org/GNOME/libsoup/-/issues/538