CVE-2026-77680

Executive Summary

CVE-2026-77680 is an algorithmic complexity (CPU starvation) denial-of-service vulnerability in libsoup's HTTP Range header processing, affecting both client- and server-side components of the library. The flaw persists in libsoup builds that already incorporate the earlier CVE-2025-32907 fix, and permits a single unauthenticated HTTP request — with a Range header containing up to 25,000 identical byte ranges — to trigger O(N²) processing time (90 ms of single-core CPU at the wire maximum) inside the server's event loop. The vulnerability is remotely exploitable, unauthenticated, and results in temporary availability impact for the target application. The affected code path is reachable through soup's server component via handle_partial_get() whenever a SoupServer handler returns HTTP 200 with a non-empty body. No memory corruption, data loss, or information disclosure occurs; the impact is strictly CPU exhaustion and service degradation. The upstream fix (merge request MR !550) is merged, but no stable release containing that fix has been confirmed as distributed at the time of reporting.

Technical Analysis

Vulnerability Mechanism

The underlying flaw is an algorithmic complexity issue (CWE-407) in libsoup's handling of HTTP Range request headers, specifically in the internal routine soup_message_headers_get_ranges_internal() located in libsoup/soup-message-headers.c.

The history of this code path is significant. A prior vulnerability (CVE-2025-32907) addressed a memory amplification attack where a client repeated the same byte range many times within a single Range: header. The fix for that CVE was commit 9bb92f7a, which corrected the merge logic so that duplicate/included ranges are properly coalesced into a single range entry.

However, the fix introduced a secondary algorithmic problem. After merging duplicate ranges, the coalescing loop removes the now-redundant merged entries from the array using g_array_remove_index(). Because GArray in GLib is a contiguous memory buffer, each removal of a mid-array element triggers an O(N) memmove() operation to shift subsequent elements leftward. When the Range: header contains thousands of identical satisfiable ranges (e.g., bytes=0-0 repeated thousands of times), the coalescing loop performs O(N²) work: for each of the N redundant entries, a memmove shifts up to N remaining elements.

Affected Code Path

The vulnerable server-side path is reachable through handle_partial_get() in libsoup/server/http1/soup-server-message-io-http1.c. This path is invoked when a SoupServer handler responds with HTTP 200 and a non-empty message body. Because soup's HTTP/1.1 server implementation honors Range requests for such responses, the soup_message_headers_get_ranges_internal() parsing and coalescing routine is exposed to attacker-controlled input. No authentication is required to reach this code path.

Attack Surface Parameters

• Maximum request header size (~100 KiB in typical HTTP server configurations) bounds the number of Range entries. Each simple byte-range specifier is ~6–8 bytes (bytes=0-0,), allowing approximately 25,000 ranges per request at the wire limit.
• Measured impact: On libsoup HEAD containing the CVE-2025-32907 fix, reporter measurements show ~90 ms of single-core CPU consumption per malicious request at the wire maximum. During this time, the server's event loop is blocked.
• Concurrency amplification: Since the server's event loop is single-threaded per connection group (in libsoup's default I/O model), a single request occupies the worker thread for ~90 ms. Sustained requests at a rate of ~11/s can saturate one core. Parallel connections can trivially saturate multiple cores.

Why This Is Not the Same As CVE-2025-32907

CVE-2025-32907 was a memory amplification issue — the repeated ranges caused disproportionate memory allocation. CVE-2026-77680 is a CPU exhaustion issue introduced as a side effect of the merge logic added to fix CVE-2025-32907. A libsoup build without the CVE-2025-32907 fix would still exhibit the memory amplification issue; a build with the fix but without MR !550 is vulnerable to this new CPU starvation issue.

Vulnerability Classification

• Type: Algorithmic complexity (CPU exhaustion / algorithmic denial of service)
• CWE: CWE-407 (Inefficient Algorithmic Complexity)
• Scope: Availability impact only — no confidentiality (C:N) or integrity (I:N) impact; low availability impact (A:L) per CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
• CVSS 5.3: Network-accessible, low attack complexity, no privileges required, no user interaction, but limited availability impact (single worker thread starvation per request; requires sustained request volume for meaningful denial of service).

Affected Builds

The vulnerable condition exists in any libsoup build that:

1. Contains the CVE-2025-32907 fix (commit 9bb92f7a or later), which introduced the merge-coalescing loop, AND
2. Does not yet include the MR !550 fix that restructures the coalescing removal.

Exact version numbers are not available from the intelligence data — "Affected Versions" field is empty in the CVE data. Patch trackers report 0/4 patch confidence, meaning no vendor-published patch evidence exists from any tracked source at the time of analysis, even though upstream MR !550 is reported as merged.

Exploitation Scenarios

Attack Chain

Step 1 — Target identification and reconnaissance. The attacker identifies Internet-facing services built on libsoup's SoupServer HTTP/1.1 stack. Common use cases include GNOME desktop applications, embedded devices, IoT gateways, media servers, and various Linux distributions' system services that use libsoup for HTTP serving. Shodan queries such as http.server:"SoupServer" or banner-based fingerprints (Server: libsoup/x.y.z) can locate candidates. The attacker then determines which libsoup version is in use (visible in Server: response headers in many configurations) to confirm the target contains the CVE-2025-32907 fix but lacks MR !550.

Step 2 — Flaw triggering. The attacker sends a single HTTP GET request to a server endpoint that is handled by a SoupServer handler that returns HTTP 200 with a non-empty body. The request includes a crafted Range: header with thousands of identical satisfiable ranges. A minimal triggering request:

GET /resource HTTP/1.1
Host: target
Range: bytes=0-0,0-0,0-0,...(repeated ~24,000 times)...

When the server's handle_partial_get() path processes this header, soup_message_headers_get_ranges_internal() parses the ranges and enters the coalescing loop. The O(N²) GArray removal operations consume ~90 ms of single-core CPU per request at the wire limit.

Step 3 — Payload / execution at vulnerability-class level. The attacker does not inject code; the attack is purely algorithmic. The "payload" is a syntactically valid HTTP Range: header with high repetition of identical satisfiable ranges. No authentication or session is required — the vector is pre-auth, network-only. The repetitive bytes=0-0 range is chosen because it is satisfiable (the resource has at least one byte), ensuring the coalescing path is exercised. Unsatisfiable ranges would take an early error path in some implementations and may not reach the vulnerable coalescing loop.

Step 4 — Post-exploitation impact. Each malicious request blocks the libsoup server worker thread for ~90 ms. Under sustained attack — e.g., 20–50 concurrent connections each sending such requests in a loop — the server's event loop becomes saturated, causing:

• Increased latency and timeouts for legitimate clients.
• Eventual denial of service for the target application.
• Possible cascading failures for dependent services (e.g., if the soup server is a front-end proxy or an API gateway).
• No data compromise, no memory corruption, no privilege escalation — pure availability impact.

Practical Considerations

No public PoC or exploit code exists at the time of reporting, and no Nuclei template is available. The attack chain above is inferred from the vulnerability mechanism described in the NVD data. The low CVSS availability sub-score (A:L) reflects that a single request alone is insufficient for a sustained DoS — the attacker needs a steady stream of requests, which increases detectability via network monitoring.

Impact Assessment

Business Impact

• Service availability: The direct impact is CPU starvation on the affected server. A single worker thread blocked for ~90 ms per request prevents the server from processing any other connections on that thread during that window. Sustained attacks render the service unusablefor legitimate clients.
• Denial of service: No authentication barrier exists. Any network client that can reach the HTTP port can consume CPU resources. This is a classic low-cost, high-frequency DoS vector — the request itself is small (~100 KiB worst case) and requires no session state.
• No data impact: CVSS scores confirm no confidentiality or integrity impact (C:N, I:N). Business operations suffer availability degradation only.
• Regulatory considerations: For organizations operating soup-based services handling regulated data, sustained unavailability may trigger SLA breach notifications or compliance-reporting obligations (e.g., uptime commitments), even though no data breach occurs.

Affected Systems

• Software: libsoup (GLib-based HTTP client/server library).
• Distributions: Any Linux distribution or embedded operating system shipping libsoup builds that postdate the CVE-2025-32907 fix (commit 9bb92f7a) but predate the MR !550 merge.
• Product categories: GNOME desktop applications using soup for local/remote HTTP serving; embedded web servers in IoT devices; media servers (e.g., those exposing HTTP-based streaming); system services that use libsoup's server API; container images bundling libsoup's server component.
• Attack surface: Any SoupServer endpoint returning HTTP 200 with a non-empty body. This includes default file-serving handlers, REST API endpoints, and media/streaming endpoints.

Blast Radius

The blast radius is confined to a single service instance. There is no privilege escalation toward the host operating system, no lateral movement, and no data impact. However, in microservice architectures where a soup-based service is a shared dependency (e.g., an internal libsoup-based gateway), the DoS could cascade to dependent applications.

Detection Guidance

Sigma Rule

title: Suspicious Repeated Identical Range Headers in HTTP Request
id: 9f6c2f1a-abcd-4def-8123-456789abcdef
status: experimental
description: >
  Detects HTTP requests with a high repetition count of identical byte-range
  specifiers in the Range header, indicating a likely attempt to exploit
  CVE-2026-77680 (libsoup O(N^2) coalescing DoS).
logsource:
  category: webserver
  product: generic
  definition: >
    Logs must include the full request header content or at least the
    Range header value, and the request path.
detection:
  selection:
    http.request.headers.range|contains|all:
      - 'bytes=0-0,'
  condition: selection
  # Optional refinement: use a regex to count occurrences of ",0-0"
  # In log sources that expose full header content, compute count via
  # a dedicated correlation engine.
fields:
  - src.ip
  - http.request.headers.range
  - http.url
falsepositives:
  - Legitimate clients using many distinct ranges are uncommon but possible;
    identical repeated ranges are almost always anomalous.
level: high
tags:
  - attack.t1499
  - attack.t1499.002
  - cve.2026-77680

YARA Rule

rule libsoup_rangeheader_repitition_dos {
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects HTTP Range headers with excessive repetition of identical byte ranges indicative of CVE-2026-77680 exploitation"
        date = "2026-06-01"
        cve = "CVE-2026-77680"
        score = 60
    strings:
        $range_prefix = "bytes=" ascii
        $range_zero = ",0-0" ascii
        $range_zero_first = "bytes=0-0" ascii
    condition:
        $range_prefix at 0 and
        ( #count of ($range_zero) > 50 or #count of ($range_zero_first) > 0 and #count of ($range_zero) > 40 )
}

Note: Apply this YARA rule to captured HTTP packet payloads (e.g., from PCAP files or full-content network logs). It is designed to flag headers where the Range: field contains dozens or more identical 0-0 entries before attempting deeper analysis.

Suricata IDS Rule

alert http any any -> any any (
    msg:"ET DoS libsoup O(N^2) Range Header Coalescing Attempt (CVE-2026-77680)";
    flow:to_server,established;
    http.header_names;
    content:"Range", nocase;
    http.header;
    content:"bytes=", nocase;
    pcre:"/(?:0-0,){40,}/i";
    classtype:attempted-dos;
    reference:cve,2026-77680;
    sid:202677680;
    rev:1;
    metadata:created_at 2026-06-01, updated_at 2026-06-01;
)

Elastic Detection

// Elastic EQL — detect HTTP requests with high repetition of Range specifiers
// Requires ingest pipeline that captures http.request.range header as array or string
any where
  // Match on HTTP transaction events (e.g., from the Suricata or Packetbeat integrations)
  event.category == "network" and
  network.protocol == "http" and
  // crude repetition signal: use length heuristic
  // A legitimate Range header rarely exceeds ~200 chars; attack headers reach ~100KB
  // Capture full header value in field http.request.headers.range
  (string(http.request.headers.range).length() > 500 or
   // Dedicated field for range-list count if normalized in the pipeline
   http.request.range.count > 100) and
  // suspicious: identical repeated range entries
  string(http.request.headers.range).matches("(?i)(0-0,){40,}")

Splunk SPL Query

index=* sourcetype=access_combined OR sourcetype=suricata
| rex field=_raw "Range:\s*(?<range_header>[^\r\n]+)"
| where isnull(range_header) == false
| eval range_count = (len(range_header) - len(replace(range_header, "0-0", ""))) / 3
| where range_count > 50
| stats count by src_ip, dest_ip, uri, range_header, _time
| sort - count

Note: The SPL query assumes raw HTTP header logs are captured (via Suricata, tshark, or a reverse proxy that logs full request headers). Replace index=* with the actual log index.

Wazuh OSSEC Rule

<group name="web,http,attack,denialofservice,">
    <rule id="101501" level="10">
        <if_sid>31100</if_sid>
        <regex type="pcre2">(?i)Range:\s*bytes=(0-0,){40,}</regex>
        <description>Potential libsoup Range header algorithmic complexity DoS attempt (CVE-2026-77680) — repeated identical byte ranges detected.</description>
        <group>atomic_test,attack.t1499,</group>
        <mitre>
            <id>T1499</id>
        </mitre>
        <info>Source IP: $(srcip) — Request path: $(url)</info>
        <options>no_full_log</options>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

While upstream reports indicate the fix (MR !550) has been merged into libsoup's development branch, no release version containing that fix has been confirmed by any tracked patch source at the time of this report. No vendor advisory has been published, no distribution backport has been announced, and no release-tagged version is confirmed as fixed.

1) Immediate Mitigations (while awaiting a patched release)

• Proactive rate limiting: Deploy WAF or reverse-proxy rules that drop or rate-limit HTTP requests where the Range: header exceeds a reasonable length (e.g., >256 characters) or contains more than, e.g., 20 range specifiers. The attack requires tens of thousands of repetitions to be effective; limiting header size defeats it.
• Request header size limitation: Reduce the maximum allowed HTTP request header size at the reverse proxy or load balancer from ~100 KiB to ~8–16 KiB. This caps the number of ranges the attacker can fit in a single request, lowering per-request CPU consumption to negligible levels.
• Access control: If the soup-based service is only needed by authenticated users, require authentication at a front-end reverse proxy to block anonymous requests to the SoupServer endpoints.
• Network segmentation: Place liquid-soup-based services behind a dedicated firewall or network ACL restricting source IP ranges to legitimate clients.
• Monitoring and alerting: Deploy the detection rules above with a low threshold to catch early reconnaissance or low-volume probing, and alert on request volumes exceeding normal baselines.

2) Patch / Upgrade Steps

• Monitor libsoup release announcements for a stable release containing MR !550. Subscribe to the libsoup GNOME GitLab repository and the soup-list mailing list.
• Distribution tracking: When a fixed stable release is published, check your OS vendor's security tracker (e.g., Ubuntu USN, Debian DSA, Red Hat RHSA) for backports to your distribution's libsoup package.
• Immediate source build option: For organizations with the capacity to build from source, apply MR !550 directly onto the libsoup checkout used in your environment. Verify the merge request has been merged into the master branch, then build and regression-test before deployment.
• Re-validate: After patching, re-run the detection rules to confirm no residual false positives.

3) Long-Term Hardening

• Adopt the CWE-407 pattern: Review in-house code for similar algorithmic complexity issues — any loop that removes elements from a contiguous array (GArray, C arrays, etc.) using a per-element removal function is a candidate for O(N²) behavior. Prefer building a new array and filtering instead.
• Input validation standards: Establish an internal standard that bounds the number of repeated elements in any single header (Range, If-Match, etc.) — not just size — to prevent algorithmic DoS.
• Timeout mechanisms: Ensure that the HTTP server stack has appropriate read/processing timeouts so that a single request cannot block a worker thread indefinitely, even to the ~90 ms level shown here. Ideally, a connection that sends a suspicious header should be terminated early.
• Continuous monitoring: Keep EPSS and CISA KEV feeds monitored — when EPSS scores this CVE, reassess exposure and prioritize patching accordingly. The CVE is currently NOT in CISA KEV and has no known in-the-wild exploitation.

References

1. NVD Entry for CVE-2026-77680 — https://nvd.nist.gov/vuln/detail/CVE-2026-77680
2. NVD Entry for CVE-2025-32907 (predecessor memory amplification issue) — https://nvd.nist.gov/vuln/detail/CVE-2025-32907
3. libsoup project — GNOME GitLab repository (source of commit 9bb92f7a and merge request MR !550) — https://gitlab.gnome.org/GNOME/libsoup/
4. MITRE ATT&CK Technique T1499 — Endpoint Denial of Service — https://attack.mitre.org/techniques/T1499/
5. CWE-407 — Inefficient Algorithmic Complexity — https://cwe.mitre.org/data/definitions/407.html

Threat actor campaigns / exploit-in-the-wild evidence: None known at the time of reporting. No public PoC, no exploit code, no Nuclei template, and no CISA KEV listing. The absence of in-the-wild exploitation does not diminish the risk for publicly exposed services — algorithmic DoS vectors are attractive precisely because they are cheap to execute and often go unnoticed in raw volume.