A stack‑based buffer overflow has been discovered in libsoup’s multipart HTTP response parser. The vulnerability arises from an incorrect length calculation, allowing a remote attacker to orchestrate memory corruption by sending a specially crafted multipart HTTP response. The resulting effects may include application crashes or arbitrary code execution and do not require authentication or user interaction, thereby affecting confidentiality, integrity, and availability for any application that processes untrusted server responses.

The flaw affects multiple Red Hat distributions, including Red Hat Enterprise Linux 6 and 7, all recent release streams of Red Hat Enterprise Linux 8 (8.2, 8.4, 8.6, 8.8, as well as the associated Advanced Update and Extended Update support branches), Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and the Red Hat OpenShift Dev Spaces version 3.26. The specific errata that contain the fix span RHSA‑2026:1948 through RHSA‑2026:2844 for the various platform versions.

The issue carries a CVSS score of 8.6, indicating a high‑severity flaw, while its EPSS score of 1 % suggests a low but non‑zero likelihood of exploitation at the time of this analysis. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, which implies no documented active exploitation yet. Exploitation requires a network path whereby the attacker can cause the vulnerable application to receive a crafted multipart HTTP response; no authentication or privileged access is needed. The attack vector is therefore remote, via the application’s HTTP client stack.