An out‑of‑bounds read flaw exists in libsoup, the HTTP library used in GNOME‑based systems. By sending specially crafted HTTP Range headers, a remote attacker can cause the library to improperly validate byte ranges and read memory beyond the intended server response. This allows the attacker to exfiltrate portions of server heap memory, potentially leaking sensitive data.

The vulnerability affects all supported Red Hat Enterprise Linux releases from 6 through 10, as these systems embed the affected libsoup library. It also impacts any GNOME‑based installations that incorporate the vulnerable libsoup component. Users of these operating systems or applications relying on libsoup should verify whether the library has been updated to the patched revision.

The CVSS score is 5.3, indicating moderate severity, while the EPSS score is less than 1 %, suggesting a low probability of exploitation at the time of this assessment. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to reach a server running the vulnerable SoupServer component and the ability to send crafted HTTP requests. Because the flaw is limited to memory disclosure rather than remote code execution, the overall impact is primarily confidentiality compromise, with modest complexity for an attacker.