Ubuntu USN-8890-2 Extends libsoup Fixes to Ubuntu 26.10
Tech GuruQuick Answer
Ubuntu USN-8890-2 supplies libsoup3 3.6.6-1ubuntu3 for Ubuntu 26.10, extending eight earlier fixes. Update the package, restart long-running clients and services, test HTTP/2, proxy, authentication, and range workflows, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Ubuntu 26.10 libsoup3 packages and dependent applications, exposure, proxy and HTTP/2 use, owners, and maintenance windows; install 3.6.6-1ubuntu3; restart consumers; test representative HTTP workflows and controls; monitor regressions; and retain evidence.
Last verified: 2026-10-22 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | libsoup3 HTTP client and server packages on Ubuntu 26.10 |
|---|---|
| Advisory | USN-8890-2 |
| CVEs | CVE-2026-4271, CVE-2026-5119, CVE-2026-6324, CVE-2026-66339, CVE-2026-77014, CVE-2026-77680, CVE-2026-85197, CVE-2026-85534 |
| Authoritative release date | 2026-10-21 21:36:06.699414 UTC |
| Authority revision date | 2026-10-21 21:36:06.699414 UTC |
| Affected versions | Ubuntu 26.10 systems with libsoup3 builds older than 3.6.6-1ubuntu3; individual issues affect HTTP/2, proxy, chunked-request, credential, and range-header processing. |
| Fixed version | stonking: libsoup3 3.6.6-1ubuntu3 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Ubuntu does not state that this issue is being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Ubuntu extended the fixes from USN-8890-1 to libsoup3 on Ubuntu 26.10. The eight vulnerabilities can cause denial of service, disclose information or proxy credentials, bypass controls, or in one HTTP/2 path permit arbitrary code execution.
What To Validate Now
- Inventory. Identify libsoup3 HTTP client and server packages on Ubuntu 26.10, exact Ubuntu release and package version, workload or service dependencies, exposure, owner, and maintenance constraints.
- Establish applicability. Match each host to USN-8890-2 and its release-specific package scope. Ubuntu 26.10 systems with libsoup3 builds older than 3.6.6-1ubuntu3; individual issues affect HTTP/2, proxy, chunked-request, credential, and range-header processing. Do not infer applicability from the package family alone.
- Remediate. Install the advisory-listed package through the supported Ubuntu or Ubuntu Pro channel, then restart or reload dependent services when required by normal operations.
- Validate. Confirm the installed package version and active process state, exercise representative dependent workflows, monitor for regressions, and retain package, change, restart, and validation evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
USN-8890-2 applies specifically to libsoup3 on Ubuntu 26.10 and refers back to USN-8890-1 for original details. Long-running applications may need restart to load the updated library, and CVE impact varies by protocol path.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
