libsoup CVE-2026-6324

Exploitation requires that libsoup be deployed in one of two specific proxy topologies: (1) libsoup operating as a backend server behind a non-libsoup reverse proxy such as nginx, HAProxy, or Apache httpd, or (2) libsoup acting as a forward proxy in front of a non-libsoup backend server. The integer conversion error in chunked encoding parsing only produces exploitable HTTP request smuggling when two HTTP implementations with differing boundary interpretations are present in the same connection path. libsoup deployments used solely as an HTTP client library - such as in GNOME desktop applications - are NOT exposed to this attack vector. Exploitation is further constrained by CVSS AC:H (High Attack Complexity), reflecting the mandatory topological prerequisite. Authentication is not required (PR:N) and no user interaction is needed (UI:N) once the proxy configuration condition is met.

The CVSS 3.1 base score of 4.8 (Medium) accurately reflects constrained exploitability. AV:N confirms the attack originates over the network, but AC:H (High Attack Complexity) captures the non-trivial prerequisite: a specific mixed-proxy topology must already exist in the target environment. PR:N and UI:N indicate no authentication or user interaction is required once that topology condition is satisfied. Impacts are bounded at C:L/I:L/A:N, meaning partial confidentiality and integrity compromise with no availability impact. EPSS data was not provided in the available input and cannot be assessed. This CVE is not in CISA KEV and no public exploit code has been identified at time of analysis. Real-world risk is elevated for organizations running libsoup in reverse-proxy or forward-proxy architectures alongside non-libsoup components, since their existing infrastructure may already satisfy the AC:H condition by design. Deployments using libsoup solely as a standalone HTTP client library face no exploitation risk from this vector. The tags 'Authentication Bypass' and 'Request Smuggling' are consistent with the CWE-444 classification and the described downstream impacts.

An attacker sends a crafted HTTP request with a malformed chunked Transfer-Encoding body to a service where libsoup acts as an intermediary proxy alongside a non-libsoup component. The unsigned-to-signed integer conversion error causes libsoup and the adjacent proxy to disagree on HTTP message boundaries, enabling the attacker to smuggle a hidden second request that bypasses authentication controls applied at the proxy layer or injects a poisoned entry into a shared web cache, affecting subsequent legitimate users. No public exploit code has been identified at time of analysis.