CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

Port details

devel/libsoup2.74.3_1

SOAP (Simple Object Access Protocol) implementation in C

Maintainer
desktop@FreeBSD.org
Packages
libsoup 2.74.3_1
Upstream
up to date
CPE
gnome:libsoup from the port
WWW
https://libsoup.org/
Links
cgit · VuXML

Unaddressed (10) · The CVE record lists this version as affected, no VuXML entry names the CVE

Updating to 3.7.3 would fix 10 of 10 unaddressed CVEs, according to the CVE records.
Fixed up to each version, cumulative: 3.6.0 1 · 3.6.1 3 · 3.6.5 4 · 3.7.3 10
CVE-2026-1025588.62026-09-29A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled …
CVE-2026-1025598.62026-09-29A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could …
CVE-2026-1025608.62026-09-29A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray gr…
CVE-2026-1025568.62026-09-29A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the …
CVE-2026-1025578.62026-09-29A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of t…
CVE-2026-1025558.22026-09-29A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_…
CVE-2024-525307.52024-11-11GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encodin…
CVE-2024-525327.52024-11-11GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain patterns of WebSocket data from clients.
CVE-2025-27847.02025-04-03A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may r…
CVE-2024-525316.52024-11-11GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_parse_param_list_strict. There is a plausible way to …

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (2)

Show 2 fixed
VuXML entries whose affected range this version has left.

Commits (147)

Joe Marcus Clarke (marcus) · 2.2.93
Update to 2.2.93.
7ac78e10f9
Jean-Yves Lefort (jylefort) · 2.2.92_1
Move the libsoup programming reference to the libsoup-reference port.
5e7a8e73ce
Joe Marcus Clarke (marcus) · 2.2.92
Presenting GNOME 2.14.1 for FreeBSD!  Checkout http://www.gnome.org/start/2.14/ for the official release notes, and a list of all the gooides in this new release.  In particular, GNOME 2.14 focused on performance, and they did not miss the mark.  There's some new eye candy, but most of the big things are waiting until GNOME 2.16.  On the FreeBSD side, we tried to clean up all the crashers we could

The good news is that this release does not bring any big shared library
version bumps, so you can almost do a simple portupgrade to get to 2.14.
There are a few minor gotchas that will be documented in UPDATING shortly.

The FreeBSD GNOME Team would like th thank the following users for their
patches, feedback, and sometimes incessant complaing about crashes (you
know who you are).

Yasuda Keisuke <kysd@po.harenet.ne.jp>
Pascal Hofstee <caelian@gmail.com>
rmgls@wanadoo.fr
tmclaugh
Yuri Pankov <yuri.pankov@gmail.com>
sajd on #freebsd-gnome
ade
ankon on #FreeBSD-Gnome
mux
Pascal Hofstee <caelian@gmail.com>
QuiRK on #freebsd-gnome
Vladimir Timofeev <vovkasm@gmail.com>
798e9bed2a
Ade Lovett (ade) · 2.2.7_2
Conversion to a single libtool environment.

Approved by:	portmgr (kris)
8503536d38
Roman Bogorodskiy (novel) · 2.2.7_1
Chase gnutls update.
17b54d4ed8
Adam Weinberger (adamw) · 2.2.7
Poot zee LDFLAGS beck intu zee CONFIGURE_ENV. Bork Bork Bork!
f74790599d
Adam Weinberger (adamw) · 2.2.7
Back out the last commit, now that the libtool-1.5.22 issue is resolved. And marcus says that the LDFLAGS should stay separate for OpenSSL purposes.
c17d6c4cd6
Adam Weinberger (adamw) · 2.2.7
Add PTHREAD_CFLAGS/LIBS to CONFIGURE_ENV, and make LDFLAGS actually be a part of CONFIGURE_ENV.
b0b024b3af
Michael Johnson (ahze) · 2.2.7
- Remove patch and remove BROKEN on 4.x

Reported by:	mjl on irc.freenode.org/#FreeBSD-GNOME
05b3433652
Joe Marcus Clarke (marcus) · 2.2.7
Mark BROKEN on 4.X.

Reported by:	pointyhat via kris
766f494acb
Michael Johnson (ahze) · 2.2.7
- Update to 2.2.7
a04bc9f8ad
Joe Marcus Clarke (marcus) · 2.2.6.1_1
Presenting GNOME 2.12 for FreeBSD.  The release is chock full of bug fixes and new features.  Don't believe me?  Then see for yourself at http://www.gnome.org/start/2.12/notes/en/.

DO NOT USE portupgrade by itself to upgrade to GNOME 2.12.  Instead, use
the gnome_upgrade.sh script from
http://www.marcuscom.com/downloads/gnome_upgrade212.sh.  This script will
circumvent some potential pitfalls users can see if they use portupgrade
by itself.

In keeping with tradition, GNOME 2.12 for FreeBSD comes with a special
splash screen.  The winner of this release's contest is
Dominique Goncalves <dominique.goncalves@gmail.com>.  His splash screen
was inspired by http://art.gnome.org/contests/2.12-splash/83.

The FreeBSD GNOME Team would lank to thank the following users for
their contributions to this release:

Matthew Luckie <mjl@luckie.org.nz>
ade
sajd on #freebsd-gnome
Caelian on #freebsd-gnome
mnag
Yasuda Keisuke <kysd@po.harenet.ne.jp>
Mark Hobden <markhobden@gmail.com>
Sergey Akifyev <asa@agava.com>
Andreas Kohn

For more information on GNOME on FreeBSD, checkout
http://www.FreeBSD.org/gnome/.  The 2.12 documentation will be
posted shortly.
e18151212d
Joe Marcus Clarke (marcus) · 2.2.6.1
Update to 2.2.6.1.
301ff955c4
Koop Mast (kwm) · 2.2.3
Update to 2.2.3.
9310d87c30
Joe Marcus Clarke (marcus) · 2.2.2_2
Bump PORTREVISION to chase the glib20 shared lib version change.
b3458f652e
Joe Marcus Clarke (marcus) · 2.2.2_1
Bump PORTREVISION since the gnutls ABI changed.

Suggested by:	kwm
a90925e870
Koop Mast (kwm) · 2.2.2
Update to 2.2.2. Changelog: o) The SSL validation fix from 2.2.1 is now completely    fixed. (Part of the fix didn't actually make it into 2.2.1) o) HTTPS certificate validation now works when using an HTTP proxy. o) HTTP proxy code deals better with proxies that try to make    the user do HTML-form-based authentication. o) 64-bit fixes for NTLM auth code.
3d038784ad
Joe Marcus Clarke (marcus) · 2.2.1
Presenting GNOME 2.8 for FreeBSD (2.8.1 to be exact).

This release notes detailing all of the new goodies in GNOME 2.8 can
be found at http://www.gnome.org/start/2.8/notes/, and the list of what
was fixed in GNOME 2.8.1 can be found at
http://lists.gnome.org/archives/gnome-announce-list/2004-October/msg00056.html.

This release, as well as all of our others, would not have been possible
without the great efforts of our FreeBSD GNOME Team.  The list of
current members can be found at http://www.freebsd.org/gnome/contact.html
(including our newest member, Michael Johnson <ahze@FreeBSD.org>).

Special thanks also goes out to all of the loyal FreeBSD GNOME users that
put up with crashes and hangs to test and debug GNOME on FreeBSD.  We would
especially like to thank those users that provided patches for GNOME 2.7 and
2.8:

Franz Klammer <klammer@webonaut.com>
Piotr Smyrak <piotr.smyrak@heron.pl>
Radek Kozlowski <radek@raadradd.com>
Khairil Yusof <kaeru@pd.jaring.my>
Yasuda Keisuke <kysd@po.harenet.ne.jp>
Tom McLaughlin <tmclaugh@sdf.lonestar.org>
Vladimir Grebenschikov <vova@fbsd.ru>

GNOME 2.8 also features a new, FreeBSD-specific splashscreen that
was designed by jimmac for GNOME 2.8, then daemonized by
Franz Klammer <klammer@webonaut.com> and Radek Kozlowski
<radek@raadradd.com>.

As with GNOME 2.6, you cannot just "portupgrade" to GNOME 2.8.  There is
a script provided at http://www.marcuscom.com/downloads/gnome_upgrade28.sh
that will aid in the upgrade process.  Full documentation on the GNOME 2.8
upgrade is coming following this commit.

From all of us at FreeBSD GNOME, ENJOY!
58406bee89
Joe Marcus Clarke (marcus) · 1.99.28_1
Apply a big libtool patch to allow porters to use the libtool installed by the libtoolX ports instead of the one included with each port.  Ports that set USE_LIBTOOL_VER=X will now use the ports version of libtool instead of the included version.  To restore previous behavior, use the new macro, USE_INC_LIBTOOL_VER.  Both macros accept the same argument: a libtool version.

For example, to use the ports version of libtool-1.5, add the following to
your Makefile:

USE_LIBTOOL_VER=        15

To use the included version of libtool with extra hacks provided by
libtool-1.5, add the following to your Makefile:

USE_INC_LIBTOOL_VER=    15

With this change, ports that had to add additional libtool hacks to prevent
.la files from being installed or to fix certain threading issues can now
delete those hacks (after appropriate testing, of course).

PR:		63944
Based on work by:eik and marcus
Approved by:	ade (autotools maintainer)
Tested by:	kris on pointyhat
Bound to be hidden problems:	You bet
9e5632dd66
Joe Marcus Clarke (marcus) · 1.99.28_1
Avoid GnuTLS support at all costs.
7b556cc7d2
Joe Marcus Clarke (marcus) · 1.99.28_1
Chase the glib20 update, and bump all affected ports' PORTREVISIONs.
731798cdcf
Joe Marcus Clarke (marcus) · 1.99.28
Ensure we do not build against GnuTLS.
e14820891e
Ade Lovett (ade) · 1.99.28
Whoa there, boy, that's a mighty big commit y'all have there...

Begin autotools sanitization sequence by requiring ports to explicitly
specify which version of {libtool,autoconf,automake} they need, erasing
the concept of a "system default".

For ports-in-waiting:

	USE_LIBTOOL=YES		->	USE_LIBTOOL_VER=13
	USE_AUTOCONF=YES	->	USE_AUTOCONF_VER=213
	USE_AUTOMAKE=YES	->	USE_AUTOMAKE_VER=14

Ports attempting to use the old style system after June 1st 2004 will be
sorely disappointed.
3f651573ad
Joe Marcus Clarke (marcus) · 1.99.28
Update to 1.99.28.
c80d808359
Joe Marcus Clarke (marcus) · 1.99.26_1
Bump PORTREVISION on all ports that depend on gettext to aid with upgrading.

(Part 2)
053fdb6a6b
Joe Marcus Clarke (marcus) · 1.99.26
Update to 1.99.26.
4162c5786c
Dirk Meyer (dinoex) · 1.99.23
- don't clobber any given LDFLAGS   resolves conflitcs with bsd.openssl.mk Approved by:	marcus
8768671836
Joe Marcus Clarke (marcus) · 1.99.23
Update to 1.99.23.
775a16610a
Joe Marcus Clarke (marcus) · 1.99.22
Update to 1.99.22.
885198ade7
Joe Marcus Clarke (marcus) · 1.99.20
Fix build on Alpha.

Reported by:	bento
44966ef7fc
Joe Marcus Clarke (marcus) · 1.99.20
Add libsoup after a repo copy from soup.  Libsoup is a SOAP API written in C and based on Glib-2.0.
e03d9deb14
Joe Marcus Clarke (marcus) · 0.7.11
Remove USE_GNOMENG.
e28f0247c9
Ade Lovett (ade) · 0.7.11
Clear moonlight beckons. Requiem mors pacem pkg-comment, And be calm ports tree.

E Nomini Patri, E Fili, E Spiritu Sancti.
7e52725f2a
Joe Marcus Clarke (marcus) · 0.7.11
Update to 0.7.11.
eee432afb1
Joe Marcus Clarke (marcus) · 0.7.10
Update to 0.7.10.
8241712514
Joe Marcus Clarke (marcus) · 0.7.4_1
Fix build when Apache 2.x is present.

Tested by:	Glenn Johnson <glennpj@charter.net>
00c2d65c56
Joe Marcus Clarke (marcus) · 0.7.4_1
Fix a problem with soup causing Evolution to segfault when trying to get RDF newsfeeds.  This is an attempt to solve both this crash as well as get it building on 64-bot architectures.
0407087089
Joe Marcus Clarke (marcus) · 0.7.4
Attempt to fix build on 64-bit platforms.

Submitted by:	bento
8bc0af39c9
Joe Marcus Clarke (marcus) · 0.7.4
GNOME has just changed the layout of their FTP site.  This resulted in making all the distfiles unfetachable.  Update all GNOME ports that fetch from MASTER_SITE_GNOME to fetch from the correct location.
59deb69012
Maxim Sobolev (sobomax) · 0.7.4
Update to 0.7.4.
1dc07f416e
Maxim Sobolev (sobomax) · 0.5.1
Convert USE_GLIB into USE_GNOMENG+USE_GNOME.
800ef6c0b0
Maxim Sobolev (sobomax) · 0.5.1
Backout previous change - it seems that new revision of the patch doesn't apply everywhere.

Submitted by:	Todd Punderson <todd@doonga.net>
d0fba3e0f1
Maxim Sobolev (sobomax) · 0.5.1
Don't filter libc_r on 5-CURRENT.
41c22e9c76
Maxim Sobolev (sobomax) · 0.5.1
Don't link in libc - FreeBSD doesn't need this.

Submitted by:	Ports Fury
b0790e4238
Maxim Sobolev (sobomax) · 0.5.1
Update to 0.5.1.
69fa60727b
Jimmy Olgeni (olgeni) · 0.2
Fix typos: INSTALL_SHLIBS -> INSTALLS_SHLIB
7a7d1e590a
Maxim Sobolev (sobomax) · 0.2
Add soup 0.2, a SOAP (Simple Object Access Protocol) implementation in C.
f9cb37cd5e