Dashboard / CVE-2026-12549

CVE-2026-12549

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 60/100
Published: 2026-06-22 Modified: 2026-11-05 First seen: 2026-11-05 Status: active

Attack Surface

Network No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: None
S: Unchanged
C: Low
I: None
A: Low

Description

The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding.

Weakness Classification (1)

Affected Software (6)

VendorProductVersion
gnome libsoup -
redhat enterprise_linux 6.0
redhat enterprise_linux 7.0
redhat enterprise_linux 8.0
redhat enterprise_linux 9.0
redhat enterprise_linux 10.0

References & Advisories (4)

Bug Bounty Relevance

60 / 100
✓ Network accessible
✓ No authentication
✓ No user interaction

CVSS Score

4.8 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

EPSS — Exploitation Probability

0.36%
Raw Score 0.003570
Percentile 29.8%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00357
2026-11-12
0.00357
2026-11-10
0.00357
2026-11-09
0.00357
2026-11-08
0.00357
2026-11-07
0.00357
2026-11-06
0.00357
2026-11-05
0.00357

Intelligence Sources

mitre ref →
nvd ref →

External Links