CVE-2026-77014

What it is

A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.

At a glance

Exploitability

Can be exploited over the network without logging in. Limited direct impact.

Exploit odds

0.2% chance of exploitation in the next 30 days (EPSS).

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-08-20 09:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-11-06 01:17 UTC Last updatedMost recent change to the record

Details

Published

2026-08-20 09:16 UTC

Last modified

2026-11-06 01:17 UTC

Exploit probability

0.2% · EPSS, next 30 days

Weakness

CWE-197

Record status

Awaiting Analysis

Attack profile CVSS 3.1 · 5.3

Attack vector

Network

Complexity

Low

Privileges needed

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None