libsoup3: Ubuntu package security update (USN-8890-2)
libsoup3. An Ubuntu security notice lists distribution packages to check. Match your Ubuntu release and installed package version to Canonical’s fixed versions.
THE SOURCE RECORD / ubuntu
Read the official source ↗- Ubuntu notice publication
- 21 Oct 2026 21:36 UTC
- Source updated
- Not stated by source
- Source checked
- 22 Oct 2026 22:15 UTC
- Source record status
- Active
- Vendor
- Canonical
- Product
- libsoup3
- Source severity
- Not stated by source
- CVE identifiers
-
- CVE-2026-4271
- CVE-2026-5119
- CVE-2026-6324
- CVE-2026-66339
- CVE-2026-77014
- CVE-2026-77680
- CVE-2026-85197
- CVE-2026-85534
- Affected products / versions
-
- Ubuntu 26.10 (stonking)
- Vendor-stated fixes
-
- Ubuntu 26.10 (stonking): libsoup3 3.6.6-1ubuntu3
- Source-recommended action
-
- In general, a standard system update will make all the necessary changes.
- Use the Ubuntu package version for your release; vendor backports can fix a flaw without matching the upstream version number.
- Known exploitation
- Not stated by source
Fix details follow this vendor's disclosure. Distribution packages may use different revisions for backported fixes.
What this update means
Ubuntu security notices describe fixes supplied through Ubuntu packages. Start with your Ubuntu release and the package actually installed. Ubuntu can backport a security patch while retaining an older upstream version number. The distribution package revision therefore matters: a lower-looking upstream version does not, by itself, show that a package is still vulnerable. A package advisory is not evidence of a breach.
What the source confirms
The Ubuntu security notice describes the issue (brief excerpt):
Several security issues were fixed in libsoup.
- Reference: USN-8890-2.
- Product: libsoup3.
- Publisher or vendor: Canonical.
- Reported severity: not supplied in this record.
- CVE identifiers: CVE-2026-4271, CVE-2026-5119, CVE-2026-6324, CVE-2026-66339, CVE-2026-77014, CVE-2026-77680, CVE-2026-85197, CVE-2026-85534.
- Source publication date: 21 October 2026.
- Exploitation: not established by this record.
Affected products or versions
- Ubuntu 26.10 (stonking)
Fixed versions or packages
- Ubuntu 26.10 (stonking): libsoup3 3.6.6-1ubuntu3
What to do next
Match the release codename and package name to the entries above. Use your configured Ubuntu update channel and Canonical’s instructions for that release, including any service restart or reboot requirements. Check whether the package belongs to standard support or an extended maintenance service. Record the installed revision after updating and verify that the application still works.
A small, read-only check
Inspect your release and installed package inventory:
lsb_release -ds
dpkg-query -W
These commands only display local information. Find the relevant package in the output and compare its complete version, including the Ubuntu revision, with the notice.
Prevention and recovery
Keep an inventory of software and its owner, retain tested backups, and review update notifications. After an approved update, check the running service and normal application behaviour. If you find signs of unauthorized access, preserve logs and involve your incident-response contact; installing a patch alone does not remove an existing intrusion.
Official source
Read the official advisory. Check it for later corrections, complete product lists and deployment instructions. This briefing explains the supplied evidence; it does not diagnose the security of any particular device.