{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/cloudlinux7els/vex/2026/cve-2026-12548-els_os-cloudlinux7els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-10-23T22:30:07Z",
      "generator": {
        "date": "2026-10-23T22:30:07Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2026-12548-ELS_OS-CLOUDLINUX7ELS",
      "initial_release_date": "2026-07-21T19:17:00Z",
      "revision_history": [
        {
          "date": "2026-07-21T19:17:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-23T22:30:07Z",
          "number": "2",
          "summary": "Official Publication"
        }
      ],
      "status": "final",
      "version": "2"
    },
    "title": "Security update on CVE-2026-12548"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "CloudLinux 7",
                "product": {
                  "name": "CloudLinux 7",
                  "product_id": "CloudLinux-7",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:cloudlinux:cloudlinux:7:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "CloudLinux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsoup-devel-0:2.62.2-2.0.13.el7.i686",
                "product": {
                  "name": "libsoup-devel-0:2.62.2-2.0.13.el7.i686",
                  "product_id": "libsoup-devel-0:2.62.2-2.0.13.el7.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libsoup-devel@2.62.2-2.0.13.el7?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-0:2.62.2-2.0.13.el7.i686",
                "product": {
                  "name": "libsoup-0:2.62.2-2.0.13.el7.i686",
                  "product_id": "libsoup-0:2.62.2-2.0.13.el7.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libsoup@2.62.2-2.0.13.el7?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsoup-devel-0:2.62.2-2.0.13.el7.x86_64",
                "product": {
                  "name": "libsoup-devel-0:2.62.2-2.0.13.el7.x86_64",
                  "product_id": "libsoup-devel-0:2.62.2-2.0.13.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libsoup-devel@2.62.2-2.0.13.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-0:2.62.2-2.0.13.el7.x86_64",
                "product": {
                  "name": "libsoup-0:2.62.2-2.0.13.el7.x86_64",
                  "product_id": "libsoup-0:2.62.2-2.0.13.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libsoup@2.62.2-2.0.13.el7?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Cloud Linux Software, Inc."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
                "product": {
                  "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
                  "product_id": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libsoup-devel@2.62.2-2.0.13.el7.tuxcare.els2?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
                "product": {
                  "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
                  "product_id": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libsoup@2.62.2-2.0.13.el7.tuxcare.els2?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
                "product": {
                  "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
                  "product_id": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libsoup-devel@2.62.2-2.0.13.el7.tuxcare.els2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
                "product": {
                  "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
                  "product_id": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libsoup@2.62.2-2.0.13.el7.tuxcare.els2?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "CloudLinux"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686"
        },
        "product_reference": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-devel-0:2.62.2-2.0.13.el7.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.i686"
        },
        "product_reference": "libsoup-devel-0:2.62.2-2.0.13.el7.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64"
        },
        "product_reference": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-devel-0:2.62.2-2.0.13.el7.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.x86_64"
        },
        "product_reference": "libsoup-devel-0:2.62.2-2.0.13.el7.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686"
        },
        "product_reference": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-0:2.62.2-2.0.13.el7.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.i686"
        },
        "product_reference": "libsoup-0:2.62.2-2.0.13.el7.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64"
        },
        "product_reference": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-0:2.62.2-2.0.13.el7.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.x86_64"
        },
        "product_reference": "libsoup-0:2.62.2-2.0.13.el7.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-12548",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "description",
          "text": "A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.i686",
          "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
          "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
          "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.x86_64",
          "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.i686",
          "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
          "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
          "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-12548"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/security/cve/CVE-2026-12548",
          "url": "https://access.redhat.com/security/cve/CVE-2026-12548"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2489996",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489996"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libsoup/-/work_items/512",
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/work_items/512"
        }
      ],
      "release_date": "2026-07-21T19:17:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "date": "2026-10-15T15:18:34.488012Z",
          "details": "This issue is a high‑complexity, user‑interaction vulnerability in libsoup’s multipart parsing that causes only a heap out‑of‑bounds read, so the impact is limited to a crash or minor information disclosure within the affected process (no integrity or code‑execution effect). Exploitation requires an application that explicitly parses attacker‑controlled multipart HTTP messages via libsoup; services that do not use libsoup for such parsing are not exposed. In centrally managed server and VM deployments where libsoup is not in the request‑processing path or does not handle multipart bodies, the practical risk is low and remediation can be safely deprioritized.",
          "product_ids": [
            "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.i686",
            "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
            "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
            "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.x86_64",
            "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.i686",
            "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
            "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
            "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.x86_64"
          ]
        }
      ]
    }
  ]
}