EUVD-2026-90226
GHSA-mfgq-q7gx-p678
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Remote unauthenticated request smuggling with no special client privileges (AV:N/PR:N); low integrity impact only (I:L) from unintended request injection; no direct confidentiality or availability loss.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3DescriptionCVE.org
A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled request, leading to unintended request handling.
AnalysisAI
HTTP request smuggling in libsoup's SoupServer - as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10 - allows remote, unauthenticated attackers to have an attacker-controlled HTTP request processed as an unintended subsequent request on a keep-alive connection. The issue triggers when an HTTP/1.x client sends 'Expect: 100-continue' with a declared body and the SoupServer-based application issues an early final (non-1xx) response before that body is read; SoupServer then neither drains the body bytes nor closes the connection, so the leftover bytes are parsed as the next request. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of: an HTTP/1.x client request carrying 'Expect: 100-continue' together with a declared request body; a persistent (keep-alive) connection; and - critically - the SoupServer-based application returning an early FINAL (non-1xx) response before the request body is read (e.g., an application that rejects/handles the request on headers alone, such as auth failures, size limits, or routing errors). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-severity issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified at time of analysis, so the primary action is to monitor the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-103399) and Bugzilla 2543949 for a fixed libsoup package and apply it as soon as it ships. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
Same weakness CWE-444 – HTTP Request/Response Smuggling
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today