oj01-creates/cve-2026-77680-security-analysisDefensive write-up of CVE-2026-77680, a libsoup HTTP Range algorithmic-complexity DoS: CVSS breakdown, kill chain mapping, detection and remediation guidance.
Assessment: Medium severity · CVSS v3.1: 5.3 · Primary impact: Availability (CPU exhaustion / denial of service)
This repository documents the technical behavior, risk, remediation, and a Cyber Kill Chain mapping for CVE-2026-77680, an algorithmic-complexity flaw in libsoup HTTP Range header processing.
CVE-2026-77680 is a denial-of-service vulnerability in the HTTP Range coalescing logic in libsoup. In affected versions, processing many repeated, satisfiable byte ranges can trigger quadratic work. The issue persists after the earlier CVE-2025-32907 fix, because the coalescing code still removed array elements individually; each removal can move the remaining elements in memory.
A remote, unauthenticated attacker may send a crafted HTTP request to a server application using the affected SoupServer path. Under the vulnerable conditions, request processing can consume disproportionate CPU time and delay other requests. The reported impact is availability only; this issue is not described as memory corruption or information disclosure.
The upstream fix replaces repeated element removal with in-place linear-time compaction and rejects Range headers requesting more than 200 ranges. Operators should install the appropriate vendor security update rather than relying solely on a perimeter workaround.
| Field | Details |
|---|---|
| CVE | CVE-2026-77680 |
| Component | GNOME libsoup (HTTP library) |
| Weakness | CWE-407 — Inefficient Algorithmic Complexity |
| Severity | Medium |
| CVSS v3.1 | 5.3 |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| Attack prerequisites | Network access to an affected service; no authentication or user interaction required |
| Main impact | CPU exhaustion and reduced service availability |
| Related issue | CVE-2025-32907 |
| Upstream fix | GNOME libsoup merge request !550 |
HTTP byte-range requests let a client request selected portions of a resource. In the vulnerable code path, libsoup coalesces overlapping or duplicate ranges. Removing an element from the middle of a contiguous GArray can require shifting the remaining elements. Repeating that operation while processing many ranges can produce O(n²) work rather than linear work.
The reported server-side path includes handle_partial_get() in libsoup/server/http1/soup-server-message-io-http1.c, with range parsing/coalescing in soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers.c. The issue is relevant when an application uses the affected server path and returns a suitable response with a non-empty body.
The number of ranges can be constrained by request-header limits rather than a sufficiently low range-count cap. Consequently, a single request can cause excessive processing, and repeated requests may amplify availability impact. Exact impact depends on the deployed version, request limits, application behavior, and server capacity.
The published CVSS v3.1 score is 5.3 (Medium).
A Medium base score does not mean the issue can be ignored: internet exposure, shared infrastructure, and repeated requests can make service availability operationally important.
Do not infer vulnerability from the presence of libsoup alone. Confirm the specific package build and whether the fix has been applied.
The Lockheed Martin Cyber Kill Chain is an intrusion-oriented model. This mapping adapts its stages to a denial-of-service scenario; not every stage represents a separate or necessary step for this vulnerability.
| Stage | Possible activity in this scenario | Defensive opportunities |
|---|---|---|
| 1. Reconnaissance | Identify a reachable application and infer its HTTP stack or behavior. | Reduce unnecessary exposure; maintain asset and software inventories; avoid disclosing unnecessary version information. |
| 2. Weaponization | Prepare an HTTP request with an excessive number of repeated or overlapping Range values. | Patch the library; validate and cap range counts; apply safe request parsing limits. |
| 3. Delivery | Send the crafted request to an exposed service. | Use network controls, reverse-proxy protections, connection limits, and request-rate controls. |
| 4. Exploitation | Trigger expensive range-coalescing work in a vulnerable server path. | Deploy the vendor/upstream fix; reject excessive ranges before expensive processing. |
| 5. Installation | Not normally applicable: this is a resource-exhaustion flaw and does not itself install malware. | Monitor for follow-on activity; do not assume service disruption implies host compromise. |
| 6. Command and Control | Not required for the basic DoS behavior. A botnet or remote controller could be used to coordinate repeated traffic, but that is not intrinsic to the CVE. | Correlate traffic across sources; apply upstream DDoS protections where appropriate. |
| 7. Actions on Objectives | Degrade response times or deny legitimate users access to the service. | Monitor availability and CPU; preserve logs; apply incident-response and recovery procedures. |
The primary outcome is service degradation or denial of service, not code execution. This distinction matters for triage: prioritize availability controls and patching, while still checking logs and telemetry for any separate indicators of compromise.
These controls reduce exposure but are not substitutes for installing the fix.
