Libsoup: denial of service in server when client requests a large amount of overlapping ranges with range header

A flaw in libsoup's HTTP range request handling allows a malicious client to send overlapping range requests multiple times in a single HTTP request, causing the server to consume excessive memory and degrade performance.

The vulnerability exists in libsoup's range request parser, which does not properly limit the number or overlap of ranges processed in a single HTTP Range header. An unauthenticated remote attacker can craft a malicious HTTP request with many overlapping byte-range specifications to exhaust server memory resources, resulting in degraded service availability without complete denial of service.