CVE-2026-12549

The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding.

• CWE-805

• https://access.redhat.com/security/cve/CVE-2026-12549Vendor Advisory, Mitigation
• https://access.redhat.com/security/cve/cve-2026-0716Vendor Advisory, Mitigation
• https://bugzilla.redhat.com/show_bug.cgi?id=2489999Issue Tracking, Vendor Advisory
• https://gitlab.gnome.org/GNOME/libsoup/-/work_items/516Exploit, Issue Tracking, Patch, Vendor Advisory

Published

Jun 22, 2026

Last Modified

Jul 8, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12536The Avada (Fusion) Builder plugin for WordPress is vulnerabl…6.4
• CVE-2026-12537Improper Neutralization used in an OS Command in the contain…7.8
• CVE-2026-12539Docker Sandboxes (sbx) blocks ICMP egress with an authorizer…5.7
• CVE-2026-1254The Modula Image Gallery – Photo Grid & Video Gallery plugin…4.3
• CVE-2026-12547SoupAuthManager caches proxy authentication credentials with…3.4
• CVE-2026-12548A heap out-of-bounds read flaw was found in libsoup. When pa…4.2
• CVE-2026-1255The YS LeadGen plugin for WordPress is vulnerable to Sensiti…7.5
• CVE-2026-12553HP has identified a potential vulnerability in HP Web Jetadm…8.9
• CVE-2026-12554Potential security vulnerabilities have been identified in H…8.5
• CVE-2026-12555Potential security vulnerabilities have been identified in H…7.7
• CVE-2026-12556Potential security vulnerabilities have been identified in H…7.7
• CVE-2026-12557The Ninja Forms - File Uploads plugin for WordPress is vulne…5.3