libsoup CVE-2026-66338

Exploitation requires that libsoup be deployed as the HTTP backend behind a strict RFC 9112-compliant frontend proxy or load balancer - this is not a default libsoup deployment topology. The proxy must enforce well-formed chunk-size syntax while libsoup's parser accepts the violating input; without this differential, no smuggling surface exists. Direct client-to-libsoup access without an intermediary proxy does not expose this vulnerability. The CVSS vector (PR:N, UI:N) confirms no attacker authentication and no victim interaction are required once this topology is present. Exploitation is further limited by SSVC's non-automatable classification, indicating that mass scanning or scripted bulk exploitation is not straightforward - successful attacks likely require topology reconnaissance and request crafting tailored to the specific proxy product and configuration in use.

The provided CVSS score of 7.2 reflects a network-reachable, scope-changing flaw with no authentication or user-interaction requirement, but multiple independent signals indicate real-world exploitability is substantially more constrained than the raw score implies. EPSS registers only 0.17% at the 7th percentile, placing this in the bottom tier of near-term exploitation likelihood across all tracked CVEs. SSVC reinforces this: exploitation is classified as none, the attack is non-automatable, and technical impact is only partial - all consistent with the topology-specific nature of HTTP request smuggling, which demands a precisely configured proxy-backend pairing to be meaningful. The S:C (scope change) in the CVSS vector is technically justified, as successful smuggling can affect resources controlled by the proxy or other users' backend sessions, but the AC:L rating overstates ease of exploitation by not accounting for the non-default deployment precondition. No KEV listing and no identified POC code further reduce urgency. Organizations running libsoup services without a strict-mode frontend proxy face no practical exposure from this specific flaw.

An attacker sends an HTTP request containing a malformed chunk-size header - for example, a size value prefixed with a plus sign or followed by alphabetic characters - to a service where a strict-mode reverse proxy (such as nginx with strict chunked parsing) fronts a libsoup-based backend. The proxy and libsoup parse the chunk boundary differently, causing libsoup to treat a portion of the attacker's request as the beginning of the next inbound request, allowing injection of an attacker-controlled request into the backend processing pipeline. No public exploit code has been identified at time of analysis, though the request-smuggling technique class is well-documented and known to security researchers.