A flaw in the libsoup library’s SoupServer component causes an integer truncation in the sort_ranges() comparator. When the subtraction result exceeds 2,147,483,647, the 64‑bit value is reduced to a 32‑bit int, flipping the sign. The consequence is that HTTP 206 Partial Content responses silently drop one or more requested byte ranges for resources larger than about 2 GB, leading to incomplete data delivery and potential data integrity problems for clients that rely on range requests.

Red Hat Enterprise Linux 6, 7, 8, 9, 10 and Red Hat OpenShift Container Platform 4 are impacted. These platforms ship the vulnerable libsoup version in their default operating system and container images.

The CVSS base score of 5.3 indicates a moderate impact. The EPSS score of less than 1 % shows very low exploitation probability and the vulnerability is not yet listed in the CISA KEV catalog. The flaw can be triggered by a remote client that requests byte ranges on large files, causing silent omission of ranges and raising data integrity concerns. No specific mitigation is available, so updating to the patched libsoup release is the only defense.