Ubuntu Security Notices
USN-8780-1

USN-8780-1: libsoup vulnerabilities

Publication date

17 September 2026

Overview

Several security issues were fixed in libsoup.

Releases

26.04 LTS 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS

Packages

libsoup2.4 - HTTP client/server library for GNOME
libsoup3 - HTTP client/server library for GNOME

Details

It was discovered that libsoup incorrectly handled certain URLs when
using an HTTP proxy. A remote attacker could possibly use this issue to
inject arbitrary HTTP headers. (CVE-2026-1467)

It was discovered that libsoup did not remove proxy authentication
credentials when following HTTP redirects. A remote attacker could
possibly use this issue to obtain sensitive information.
(CVE-2026-1539)

Ahmed Lekssays discovered that libsoup incorrectly parsed certain HTTP
requests. A remote attacker could possibly use this issue to obtain
sensitive information. (CVE-2026-1801)

It was discovered that libsoup incorrectly handled certain URLs when
using an HTTP proxy. A remote attacker could possibly use this issue to
inject arbitrary HTTP headers. (CVE-2026-1467)

Ahmed Lekssays discovered that libsoup incorrectly parsed certain HTTP
requests. A remote attacker could possibly use this issue to obtain
sensitive information. (CVE-2026-1801)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release	Package Version
26.04 LTS resolute	gir1.2-soup-2.4 – 2.74.3-10.1ubuntu5+esm2
	libsoup-2.4-1 – 2.74.3-10.1ubuntu5+esm2
	libsoup-gnome-2.4-1 – 2.74.3-10.1ubuntu5+esm2
	libsoup-gnome2.4-dev – 2.74.3-10.1ubuntu5+esm2
	libsoup2.4-common – 2.74.3-10.1ubuntu5+esm2
	libsoup2.4-dev – 2.74.3-10.1ubuntu5+esm2
24.04 LTS noble	gir1.2-soup-2.4 – 2.74.3-6ubuntu1.8
	gir1.2-soup-3.0 – 3.4.4-5ubuntu0.8
	libsoup-2.4-1 – 2.74.3-6ubuntu1.8
	libsoup-3.0-0 – 3.4.4-5ubuntu0.8
	libsoup-3.0-common – 3.4.4-5ubuntu0.8
	libsoup-3.0-dev – 3.4.4-5ubuntu0.8
	libsoup-gnome-2.4-1 – 2.74.3-6ubuntu1.8
	libsoup-gnome2.4-dev – 2.74.3-6ubuntu1.8
	libsoup2.4-common – 2.74.3-6ubuntu1.8
	libsoup2.4-dev – 2.74.3-6ubuntu1.8
22.04 LTS jammy	gir1.2-soup-2.4 – 2.74.2-3ubuntu0.8
	gir1.2-soup-3.0 – 3.0.7-0ubuntu1+esm8
	libsoup-3.0-0 – 3.0.7-0ubuntu1+esm8
	libsoup-3.0-common – 3.0.7-0ubuntu1+esm8
	libsoup-3.0-dev – 3.0.7-0ubuntu1+esm8
	libsoup-gnome2.4-1 – 2.74.2-3ubuntu0.8
	libsoup-gnome2.4-dev – 2.74.2-3ubuntu0.8
	libsoup2.4-1 – 2.74.2-3ubuntu0.8
	libsoup2.4-common – 2.74.2-3ubuntu0.8
	libsoup2.4-dev – 2.74.2-3ubuntu0.8
20.04 LTS focal	gir1.2-soup-2.4 – 2.70.0-1ubuntu0.5+esm3
	libsoup-gnome2.4-1 – 2.70.0-1ubuntu0.5+esm3
	libsoup-gnome2.4-dev – 2.70.0-1ubuntu0.5+esm3
	libsoup2.4-1 – 2.70.0-1ubuntu0.5+esm3
	libsoup2.4-dev – 2.70.0-1ubuntu0.5+esm3
18.04 LTS bionic	gir1.2-soup-2.4 – 2.62.1-1ubuntu0.4+esm8
	libsoup-gnome2.4-1 – 2.62.1-1ubuntu0.4+esm8
	libsoup-gnome2.4-dev – 2.62.1-1ubuntu0.4+esm8
	libsoup2.4-1 – 2.62.1-1ubuntu0.4+esm8
	libsoup2.4-dev – 2.62.1-1ubuntu0.4+esm8
16.04 LTS xenial	gir1.2-soup-2.4 – 2.52.2-1ubuntu0.3+esm7
	libsoup-gnome2.4-1 – 2.52.2-1ubuntu0.3+esm7
	libsoup-gnome2.4-dev – 2.52.2-1ubuntu0.3+esm7
	libsoup2.4-1 – 2.52.2-1ubuntu0.3+esm7
	libsoup2.4-dev – 2.52.2-1ubuntu0.3+esm7

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

USN-8020-1

USN-8020-1