Vulnerability Report

CVE-2026-12549

Title: Malformed HTTP 206 Responses and Log Flooding

DoS

Proof Of Concept

No public PoC currently indexed for CVE-2026-12549.

CWE Category CWE-805

Published Date Jun 22, 2026

Modified Date Jul 08, 2026

Exploit Status Not Found

Score 4.8 CVSS v3.1

Exploit Probability (EPSS)

0.41%

Vulnerability Summary

CVE-2026-12549: The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding.

Impacted Vendors

libsoup 1

gnome 1

Reference Links

https://access.redhat.com/security/cve/CVE-2026-12549 https://access.redhat.com/security/cve/cve-2026-0716 https://bugzilla.redhat.com/show_bug.cgi?id=2489999 https://gitlab.gnome.org/GNOME/libsoup/-/work_items/516

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

4.8

Attack Vector

NETWORK

Complexity

HIGH

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-12549 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

July 08, 2026 MODIFIED

Vulnerability data updated via NVD.

June 23, 2026 MODIFIED

Vulnerability data updated via NVD.

June 22, 2026 MODIFIED

Vulnerability data updated via NVD.

June 22, 2026 MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity HIGH

Privileges N/A

Interaction NONE

CVSS Vector String


                                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected Stack

No specific products linked.