Ubuntu Reissues libsoup Security Update After Earlier Fix Introduced Cookie Jar Memory Leak
Canonical has published USN-8890-3, a corrective update for the libsoup HTTP library on Ubuntu. The previous advisory in this chain, USN-8890-1, fixed eight separate vulnerabilities in libsoup but introduced a memory leak in the cookie jar and could cause a regression. The new update resolves that problem while retaining the original security fixes. libsoup is the HTTP client and server library used widely across GNOME desktop applications and other services on Ubuntu, so the affected population is broad rather than tied to a single product. The originally patched issues span Ubuntu 22.04 LTS, 24.04 LTS and 26.04 LTS, with some limited to specific releases.
The vendor has not published exploitation details or proof-of-concept mechanics for any of the eight flaws, so only the behaviour described in the advisory is known. CVE-2026-4271 and CVE-2026-85534 involve mishandled HTTP/2 requests and transfers that a remote attacker could use to cause denial of service, with CVE-2026-4271 affecting only 24.04 LTS and 26.04 LTS. CVE-2026-5119 concerns HTTPS proxy connections and CVE-2026-66339 proxy authentication credentials, both potentially leading to disclosure of sensitive information. CVE-2026-6324 stems from incorrect parsing of chunked HTTP requests and could allow security controls to be bypassed, while CVE-2026-77014 and CVE-2026-77680 relate to HTTP Range header handling and denial of service. CVE-2026-85197 covers HTTP/2 connection handling and is described as potentially allowing information disclosure or arbitrary code execution.
The practical significance here is twofold. Systems that took the earlier fix are carrying a memory leak in long-running processes that use libsoup cookie handling, which degrades stability over time even though the security holes themselves were closed. Systems that never took it remain on an unpatched library reachable through ordinary HTTP and HTTPS traffic. On current exploitation status, FIRST EPSS places all eight CVEs at or below a 1.3 percent probability of exploitation in the next 30 days, the highest being CVE-2026-6324 at 1.3 percent and the lowest CVE-2026-66339 and CVE-2026-77014 at 0.2 percent. No in-the-wild exploitation is reported.
Attack Surface
Endpoint OS, Server OS, Web Application
Tactics
Initial Access, Execution, Credential Access, Defense Evasion, Impact
Techniques
- T1190 – Exploit Public-Facing Application
- T1203 – Exploitation for Client Execution
- T1499 – Endpoint Denial of Service
- T1557 – Adversary-in-the-Middle
SuperPRO's Threat Countermeasures Procedures
- Apply the corrected libsoup update published in USN-8890-3 on Ubuntu 22.04 LTS, 24.04 LTS and 26.04 LTS. This is the fixed build that supersedes USN-8890-1 and removes the cookie jar memory leak that update introduced; Canonical does not publish package version strings in the notice text, so match against USN-8890-3 rather than a version number. Treat this as a scheduled maintenance-window change, not an out-of-hours emergency, given no confirmed exploitation and EPSS at or below 1.3 percent.
- Inventory hosts that already took USN-8890-1 and have not yet moved to USN-8890-3, and prioritise them first: these systems are security-patched but carry the cookie jar memory leak, so they will degrade rather than simply remain vulnerable.
- After updating, identify processes still holding the old library mapped with 'lsof | grep libsoup' or 'sudo needrestart -r l', and restart those services so the corrected library is actually loaded into long-running GNOME and HTTP client processes.
- On Ubuntu 24.04 LTS and 26.04 LTS, restrict external reachability of any service that terminates HTTP/2 through libsoup until USN-8890-3 is applied, since CVE-2026-4271 is an HTTP/2 request-handling denial of service limited to those two releases and CVE-2026-85534 covers HTTP/2 transfers.
- Audit HTTPS proxy configuration used by libsoup-based clients and rotate stored proxy authentication credentials on hosts that ran the unpatched library, as CVE-2026-5119 and CVE-2026-66339 concern HTTPS proxy connections and proxy authentication credential handling respectively.
- Add a reverse-proxy or WAF rule in front of libsoup-backed services that rejects requests presenting both Transfer-Encoding: chunked and Content-Length, or duplicate Transfer-Encoding headers, to cover the chunked-request parsing bypass tracked as CVE-2026-6324.
- Normalise or cap HTTP Range headers at the upstream proxy, rejecting requests carrying an excessive number of byte ranges, to blunt the Range-header denial-of-service conditions tracked as CVE-2026-77014 and CVE-2026-77680, which affect all supported Ubuntu releases.
