Skip to main content

libsoup CVE-2026-66338

| EUVDEUVD-2026-48752 HIGH
HTTP Request/Response Smuggling (CWE-444)
2026-07-24 secalert@redhat.com GHSA-8wm8-3499-x4v9
Request Smuggling Information Disclosure Libsoup Enterprise Linux
High
Disputed · 7.2 NVD
Share

Severity by source

Sources disagree (Low–High)
NVD PRIMARY
7.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
vuln.today AI
5.4 MEDIUM

AC:H assigned independently because exploitation requires a non-default proxy-backend topology; all other metrics preserved from the provided vector as technically justified.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
SUSE
HIGH
qualitative
Red Hat
5.4 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

5
Analysis Updated
Aug 24, 2026 - 17:02 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 24, 2026 - 16:52 vuln.today
cvss_changed
Severity Changed
Aug 24, 2026 - 16:52 NVD
MEDIUM HIGH
CVSS changed
Aug 24, 2026 - 16:52 NVD
5.4 (MEDIUM) 7.2 (HIGH)
Analysis Generated
Jul 26, 2026 - 12:11 vuln.today

DescriptionNVD

A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests.

AnalysisAI

HTTP request smuggling in libsoup (GNOME's HTTP client/server library) enables network-accessible attackers to inject hidden requests into backend streams by exploiting a parsing differential between libsoup's permissive chunked transfer encoding parser and strict RFC 9112-compliant frontend proxies. All libsoup versions are affected as tracked under CPE cpe:2.3:a:gnome:libsoup, with confirmed vendor impact across Red Hat Enterprise Linux 6.0 through 10.0. No public exploit code or active exploitation has been identified at time of analysis; SSVC classifies exploitation as none with non-automatable, partial technical impact.

Technical ContextAI

libsoup is GNOME's HTTP client/server library (CPE: cpe:2.3:a:gnome:libsoup:-:*:*:*:*:*:*:*), broadly used in Linux desktop applications, GNOME-stack services, and server components on RHEL 6.0-10.0. The root cause (CWE-444, HTTP Request/Response Smuggling) is a permissive chunk-size parsing function that silently accepts inputs violating RFC 9112: chunk sizes prefixed with leading whitespace, a plus sign, or followed by trailing non-numeric characters. When a strict reverse proxy enforces well-formed chunked encoding and forwards requests to a libsoup backend, the two components disagree on where HTTP message bodies end. This desynchronization of parser state allows an attacker to craft a single request that the proxy treats as one message but libsoup interprets as two - the second being an attacker-controlled, smuggled request injected into the backend pipeline.

RemediationAI

The primary remediation path is to apply Red Hat errata packages for the affected RHEL release as published at https://access.redhat.com/security/cve/CVE-2026-66338, tracked via Bugzilla entry 2506950. No exact patched version number is confirmed from the available intelligence; administrators should monitor the Red Hat advisory directly for errata availability specific to their RHEL major version. As a compensating control where patching is not immediately possible, configuring the frontend proxy to normalize or reject malformed chunk-size fields - for example, blocking headers with leading whitespace, plus-sign prefixes, or trailing non-numeric characters before forwarding - eliminates the parsing differential that enables smuggling. Note that aggressive normalization rules may reject non-standard but benign clients; test in a staging environment before enforcing in production. If the application does not require chunked transfer encoding, disabling TE: chunked at the proxy layer entirely (by buffering requests fully before forwarding) is a high-confidence workaround with minimal client compatibility risk. Removing the strict frontend proxy from the architecture, if operationally feasible, also eliminates the attack surface entirely since direct access to libsoup removes the differential.

More in Libsoup

View all
CVE-2019-17266 CRITICAL POC
9.8 Oct 06

libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soup_ntlm_parse_challenge() in soup
CVE-2024-52530 HIGH POC
7.5 Nov 11

GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of he
CVE-2025-2784 MEDIUM POC
6.5 Apr 03

A flaw was found in libsoup. Rated high severity (CVSS 7.0), this vulnerability is remotely exploitable, no authenticati
CVE-2024-52531 MEDIUM POC
6.5 Nov 11

GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_pars
CVE-2018-12910 CRITICAL
9.8 Jul 05

The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty
CVE-2024-52532 HIGH
7.5 Nov 11

GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. Rated high severity (CVSS 7.5), this vulnerabil
CVE-2026-66339 MEDIUM
6.5 Jul 24

libsoup leaks proxy credentials to destination servers via Proxy-Authorization header attachment after CONNECT tunnel es
CVE-2026-66337 MEDIUM
6.5 Jul 24

Heap buffer over-read in libsoup's multipart response parser allows remote, unauthenticated attackers to crash client ap
CVE-2026-2369 MEDIUM
6.5 Mar 19

libsoup versions prior to the patched release contain an integer underflow vulnerability in zero-length resource process
CVE-2018-11713 MEDIUM
6.5 Jun 04

WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKit
CVE-2012-2132 MEDIUM
5.0 Aug 20

libsoup 2.32.2 and earlier does not validate certificates or clear the trust flag when the ssl-ca-file does not exist, w
CVE-2026-12548 MEDIUM
4.2 Jul 21

Heap out-of-bounds read in libsoup's multipart HTTP message parser allows remote attackers to crash affected application

Same weakness CWE-444 – HTTP Request/Response Smuggling

View all
CVE-2023-41265 CRITICAL POC
9.9
CVE-2021-33037 MEDIUM
5.3
CVE-2018-3907 CRITICAL POC
10.0
CVE-2024-10264 CRITICAL POC
9.8
CVE-2022-2466 CRITICAL POC
9.8
CVE-2020-7611 CRITICAL POC
9.8
CVE-2020-10109 CRITICAL POC
9.8
CVE-2020-10108 CRITICAL POC
9.8

Same technique Request Smuggling

View all
CVE-2023-41265 CRITICAL POC
9.9
CVE-2021-33037 MEDIUM
5.3
CVE-2018-3907 CRITICAL POC
10.0
CVE-2024-10264 CRITICAL POC
9.8
CVE-2022-2466 CRITICAL POC
9.8
CVE-2020-7611 CRITICAL POC
9.8
CVE-2020-10109 CRITICAL POC
9.8
CVE-2020-10108 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected

Share

CVE-2026-66338 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy