libsoup CVE-2026-6324

Monitor and apply the vendor-supplied errata from Red Hat once published; the advisory is tracked at https://access.redhat.com/security/cve/CVE-2026-6324 and Bugzilla entry 2458479. No specific patched libsoup version number is confirmed in the available input data - patch availability is inferred from the existence of an upstream GitLab issue (#508) but a released fix version has not been independently verified, so treat patch status as 'upstream fix in progress' until Red Hat publishes errata. As an immediate compensating control, audit all deployments to identify where libsoup components sit in a proxy chain alongside non-libsoup intermediaries; eliminating the mixed-proxy topology removes the attack surface entirely and carries no functional downside if an alternative intermediary is available. Where topology changes are not feasible, deploying an HTTP normalization layer or WAF between the proxy boundary can reduce the ability to craft divergently interpreted chunked payloads, though this adds latency and operational overhead. Additionally, disabling HTTP response caching on affected proxy nodes until a patch is applied directly mitigates the cache poisoning impact vector.