Fedora 43 libsoup3 Security Update: Defending Against Code Execution and DoS Flaws in GNOME's HTTP Stack

Fedora has pushed a security update for libsoup3 on Fedora 43 addressing multiple CVEs that, per the advisory, include a critical code execution flaw and denial-of-service risks. If you run Fedora 43 workstations, GNOME-based desktops, or any server workload that links against libsoup3, this is a same-day patching event — not a backlog item.

Why the urgency? libsoup isn't some obscure corner library. It is the HTTP client/server implementation underpinning the GNOME ecosystem: Evolution, GNOME Software, Geary, Epiphany, GNOME Online Accounts, and a long tail of third-party applications that make HTTP requests or — more dangerously — parse untrusted HTTP responses and headers. A memory corruption flaw in a library that spends its life ingesting attacker-controlled data from the network is exactly the class of bug that turns into remote code execution with a single malicious server response, phishing redirect, or man-in-the-middle position.

The advisory is available at LinuxSecurity / Fedora libsoup3 2026-f3ca65c0c9. Below is the defensive breakdown: what's affected, how exploitation realistically unfolds, how to hunt for it, and how to close the window.

Technical Analysis

Affected Products and Platforms

Component: libsoup3 (the GTK4/GNOME 41+ generation of the libsoup HTTP library)
Distribution: Fedora Linux 43 (all spins and derivatives shipping libsoup3 — Workstation, KDE spin systems with GNOME apps installed, Silverblue/Kinoite via layered packages, Server editions with GNOME components)
Exposure surface: Any application dynamically linked against libsoup-3.0.so.0. On a typical Fedora 43 Workstation this includes Evolution, GNOME Software, Geary, gnome-online-accounts, gnome-remote-desktop, and third-party Flatpak-adjacent tools using the system runtime.

The advisory covers several CVEs in a single update. Fedora bundles library fixes this way routinely; treat the package-level update as your unit of remediation rather than chasing individual CVE patches.

Vulnerability Class and Attack Chain

Based on the advisory's characterization — critical code execution plus DoS — the defects sit in libsoup3's parsing and message-handling code paths. The realistic attack chain from a defender's perspective:

Delivery: The victim's libsoup3-linked application connects to an attacker-controlled or compromised HTTP(S) endpoint. This does not require the user to open a browser — GNOME components fetch data in the background: Evolution pulls RSS and calendar feeds, GNOME Software checks repository metadata, Online Accounts syncs with cloud providers. Redirect chains, malicious feeds, or a compromised upstream server are all viable delivery vectors.
Trigger: libsoup3 parses a malformed response — crafted headers, chunked transfer bodies, multipart content, or WebSocket frames (libsoup3 handles all of these) — hitting the vulnerable code path.
Impact: Memory corruption yields either a crash (denial of service against the host application — and libsoup runs in-process, so a crash takes down the whole application) or, in the critical case, controlled corruption that an attacker develops into arbitrary code execution in the context of the victim application's user.

The DoS side deserves respect in its own right: on shared systems or kiosk-style deployments, a repeatable crash primitive against a core GNOME component is an availability problem, and crash loops are frequently the observable exhaust of failed exploitation attempts.

Exploitation Status

The Fedora advisory does not indicate confirmed in-the-wild exploitation at publication, and these CVEs are not currently listed in the CISA Known Exploited Vulnerabilities catalog. That said, HTTP parsing bugs in widely deployed libraries historically attract rapid PoC development once a patch diff is public — the update itself maps the vulnerable code. Assume the exploitation clock started when the advisory shipped. The gap between patch release and public PoC for library-level parsing flaws is routinely measured in days, not months.

Detection & Response

Library-level HTTP parsing flaws don't leave classic IOCs — there are no dropped binaries or registry keys to key on. Detection must therefore focus on behavioral anomalies: libsoup-linked applications crashing unexpectedly, spawning children they never should, or initiating outbound connections inconsistent with their role. These are high-signal, low-noise detections precisely because GNOME components are so well-behaved in their normal operation.

YAML

---
title: GNOME libsoup-Linked Application Spawning Shell or Script Interpreter
id: 3f8c2a91-7d4e-4b1a-9f2c-8e6d5a4b3c21
status: experimental
description: Detects known libsoup3-linked GNOME applications spawning shell or scripting interpreters, consistent with post-exploitation activity following memory corruption in HTTP response parsing.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-libsoup3-2026-f3ca65c0c9
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/evolution'
      - '/gnome-software'
      - '/geary'
      - '/goa-daemon'
      - '/gnome-remote-desktop'
      - '/epiphany'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Evolution invoking external editors or helpers via configured plugins
  - Rare desktop integration scripts
level: high
---
title: Repeated Crashes of libsoup3-Linked GNOME Processes
id: 9b1e4d72-5a3c-4f88-b2d7-6c9e1a3f5d84
status: experimental
description: Detects segmentation faults or aborts in libsoup3-linked applications logged by the kernel or systemd-coredump, indicating potential exploitation attempts or DoS triggering against the vulnerable HTTP parsing code.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-libsoup3-2026-f3ca65c0c9
  - https://attack.mitre.org/techniques/T1499/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.impact
  - attack.t1499
logsource:
  category: process_event
  product: linux
detection:
  selection:
    - Image|endswith:
        - '/evolution'
        - '/gnome-software'
        - '/geary'
        - '/goa-daemon'
        - '/epiphany'
    - Message|contains:
        - 'segfault'
        - 'SIGSEGV'
        - 'libsoup-3.0'
        - 'core dumped'
  condition: selection
falsepositives:
  - Unrelated application instability; baseline crash rates per host before tuning
level: medium

KQL — Microsoft Sentinel / Defender

// Hunt for crash events and anomalous process behavior in libsoup3-linked GNOME applications
// Requires Syslog ingestion from Fedora hosts into Sentinel (CEF/Syslog connector)
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("libsoup-3.0", "segfault", "core dumped", "SIGSEGV")
| where SyslogMessage has_any ("evolution", "gnome-software", "geary", "goa-daemon", "epiphany", "gnome-remote-desktop")
| summarize CrashCount = count(), DistinctMessages = dcount(SyslogMessage) by Computer, ProcessName, bin(TimeGenerated, 1h)
| where CrashCount >= 2
| sort by CrashCount desc

KQL — Microsoft Sentinel / Defender

// Hunt for libsoup-linked GNOME apps spawning unexpected child processes (post-exploitation behavior)
// Requires auditd/Sysmon-for-Linux process creation telemetry forwarded to Sentinel
Syslog
| where TimeGenerated > ago(7d)
| where Facility == "user" or SyslogMessage has "audit"
| where SyslogMessage has_any ("evolution", "gnome-software", "geary", "goa-daemon", "epiphany")
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "python3", "/usr/bin/curl", "/usr/bin/wget")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| sort by TimeGenerated desc

VQL — Velociraptor

-- Velociraptor hunt: inventory running libsoup3-linked processes and their network connections
-- Deploy across Fedora 43 endpoints to identify exposure and anomalous outbound sessions

-- First: enumerate processes linked against libsoup3 currently running
SELECT Pid, Name, Exe, Username, CommandLine, CreateTime
FROM pslist()
WHERE Name =~ '(evolution|gnome-software|geary|goa-daemon|epiphany|gnome-remote)'

-- Second: correlate with active network connections from those processes
SELECT Pid, Name, Status,
       Laddr.IP AS LocalIP, Laddr.Port AS LocalPort,
       Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort
FROM netstat()
WHERE Name =~ '(evolution|gnome-software|geary|goa-daemon|epiphany)'
  AND Status =~ 'ESTABLISHED'

Bash / Shell

#!/usr/bin/env bash
# Fedora 43 libsoup3 remediation and verification script
# Run as root or via sudo on all Fedora 43 systems

set -euo pipefail

echo "=== [1/4] Current libsoup3 version ==="
rpm -q libsoup3 || echo "libsoup3 not installed"

echo "=== [2/4] Applying security update ==="
dnf update -y --refresh libsoup3

echo "=== [3/4] Verify patched version installed ==="
PATCHED_VER=$(rpm -q libsoup3)
echo "Installed: ${PATCHED_VER}"
# Cross-reference against the advisory: https://linuxsecurity.com/advisories/fedora/fedora-libsoup3-2026-f3ca65c0c9

echo "=== [4/4] Identify processes still holding the OLD library in memory ==="
# Processes that loaded libsoup-3.0.so.0 before the patch remain vulnerable until restarted
if command -v lsof >/dev/null 2>&1; then
  lsof 2>/dev/null | grep 'libsoup-3.0.so.0' | grep 'DEL\|deleted' || echo "No stale libsoup3 mappings found."
else
  for pid in $(ls /proc | grep -E '^[0-9]+$'); do
    if grep -q 'libsoup-3.0.so.0.*(deleted)' /proc/${pid}/maps 2>/dev/null; then
      echo "PID ${pid} ($(cat /proc/${pid}/comm 2>/dev/null)) holds deleted libsoup3 — restart required"
    fi
  done
fi

echo ""
echo "ACTION REQUIRED: Restart any listed processes, or reboot the host to guarantee"
echo "all libsoup3 consumers load the patched library. A dnf update alone does NOT"
echo "protect processes that already had the old library mapped."

Remediation

Patch immediately: sudo dnf update -y --refresh libsoup3 on all Fedora 43 systems. Confirm the installed version matches the fixed build referenced in the advisory. For Silverblue/Kinoite: rpm-ostree update followed by a reboot.
Restart dependent processes — this step is not optional. libsoup3 is a shared library. Every process that loaded it before the patch continues running the vulnerable code until restarted. On workstations, a reboot is the cleanest guarantee; on servers, use the detection script above to enumerate stale mappings and restart targeted services.
Inventory your exposure. Run dnf repoquery --whatrequires libsoup3 and ldd audits across your fleet to identify every application linking the library. Custom or third-party software statically linking libsoup3 needs a rebuild, not just a package update.
Reduce the attack surface where patching lags: disable unused GNOME Online Accounts integrations, remove RSS feed accounts in Evolution on unmanaged machines, and restrict outbound HTTP(S) from server-class systems that have no business fetching remote content.
Watch crash telemetry. A spike in segfaults for Evolution, GNOME Software, or goa-daemon in the days following patch release is a meaningful signal — it often indicates either active probing or a failed exploit attempt against an unpatched host.
Monitor for follow-on advisories. Bundled Fedora library updates sometimes precede coordinated upstream disclosure. Track the libsoup GNOME GitLab and the Fedora security-announce list for the underlying CVE details as they publish.

There are currently no CISA KEV deadlines attached to these CVEs, but the combination of network-reachable parsing code, background-fetch behavior, and a public patch diff makes rapid remediation the only sensible posture.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub