CVE-2026-15714: Libsoup: soupmultipartinputstream: libsoup: out-of-bounds read in soup_multipart_input_stream_read_headers via an oversized multipart boundary string

Vulnerability Reference:

An out-of-bounds (OOB) read flaw was discovered in libsoup's multipart input streaming parser, allowing a remote attacker to trigger a crash or potentially expose sensitive memory contents.

Component / Vulnerable Part:

libsoup -> Multipart handling engine (libsoup/soup-multipart-input-stream.c -> soupmultipartinputstreamreadheaders())

Technical Analysis & Root Cause:

When an application utilizing a SoupSession parses a multipart MIME message response, it invokes soupmultipartinputstreamreadheaders() to extract contextual block structures. A validation vulnerability exists where the logic fails to enforce strict length limits on the incoming boundary string delimiter. If a malicious remote endpoint supplies an exceptionally large multipart boundary string, the internal memory pointer indexing calculations drift past the expected buffer boundaries, triggering an out-of-bounds read operation on the heap or stack layout.

Impact:

A remote, unauthenticated attacker serving a malformed multipart HTTP payload can cause the application process to terminate unexpectedly (Denial of Service) via a segmentation fault or glean layout information from adjacent memory locations.

— Red Hat