Description

A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-20T09:16:48.167Z",
  "pubdate": "2026-08-20T09:16:48.167Z",
  "executiveSummary": "An integer truncation vulnerability exists in libsoup's SoupServer HTTP Range header processing mechanism. The flaw resides within the sort_ranges() comparator located in soup-message-headers.c, where a 64-bit subtraction result is explicitly truncated to a 32-bit signed integer. This type conversion results in sign-flipping when evaluating range offsets that differ by a magnitude greater than INT_MAX (approximately 2 GB).\nThe impact of this vulnerability manifests as the silent omission of requested byte ranges from HTTP 206 Partial Content responses, specifically targeting resources exceeding 2 GB in size. This behavior violates HTTP protocol specifications regarding range requests, potentially leading to denial of service conditions, data corruption in applications relying on partial content transfers, or logic bypasses in parsers expecting complete or sequentially ordered byte range responses.\nThe affected product is libsoup, specifically within the SoupServer component handling HTTP range requests. The risk implications primarily involve functional integrity and availability of large file transfers. Attackers do not require special authentication, privileges, or complex exploitation vectors; the condition can be triggered purely through network exposure by issuing maliciously crafted or naturally occurring large HTTP Range header requests containing offsets exceeding INT_MAX.",
  "technicalDetails": "The vulnerability stems from improper integer type casting and arithmetic operations during the sorting of HTTP Range headers. The vulnerable component is the sort_ranges() comparator function implemented in the soup-message-headers.c source file of libsoup's SoupServer implementation.\nRoot Cause Analysis: When parsing and processing incoming HTTP Range headers for resources larger than 2 GB, the application compares multiple requested byte ranges. The internal comparator function performs a subtraction operation between 64-bit range offset values. However, the resulting 64-bit difference is improperly cast and truncated down to a 32-bit signed integer (int). When the arithmetic difference between two range offsets exceeds the maximum positive value representable by a 32-bit signed integer (INT_MAX, or 2,147,483,647), an integer overflow occurs, causing the most significant bits to be discarded and unexpectedly flipping the sign of the resulting value.\nAttack Flow and Exploitation: An unauthenticated network attacker interacts with the SoupServer by sending an HTTP GET request containing a crafted 'Range' header specifying multiple non-contiguous or large byte ranges spanning across or beyond the 2 GB threshold. Upon receiving the request, SoupServer invokes the vulnerable sort_ranges() function to organize the requested offsets before generating the HTTP 206 Partial Content response.\nDue to the truncation and subsequent sign-flipping in the comparator, the sorting algorithm fails to order the ranges correctly. Consequently, the internal logic drops or silently omits specific requested byte ranges from the final multipart/byteranges payload returned to the client. This breaks deterministic data retrieval for large assets, disrupting clients expecting complete segment coverage and potentially causing application crashes, hangs, or incorrect data processing in downstream parsers."
}