USN-8890-1: libsoup flaws call for review and fixes

What happened and what to do

Published on October 6, 2026, notice USN-8890-1 reports libsoup flaws involving HTTP/2 requests and connections, HTTPS proxy connections and credentials, chunked requests, and HTTP Range headers. Possible impacts include denial of service, exposure of confidential information, bypass of security controls, and arbitrary code execution. The notice specifies that some flaws affect Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS, while others have a narrower scope or do not state affected versions in the text. The original publication can be consulted in Ubuntu Security under identifier USN-8890-1; the CVEs listed in the notice allow each flaw and its scope to be checked.

A practical response is to inventory systems and applications using libsoup, check their versions, and apply the relevant Ubuntu updates. A company can also monitor fix coverage, test services that process HTTP traffic, and review proxy controls and exposure to remote requests, without assuming every installation is affected in the same way.

How the consultancy can help

Wendelmaques can diagnose where libsoup is present and assess exposure, define a remediation scope, and implement inventory, monitoring, and security checks. Operating the process and tracking fixes can also be included in the proposal.

Next step

Send a short description of the Ubuntu systems and services involved to receive a proposal scoped for diagnosis, implementation, and follow-up.