EUVD-2026-25306
GHSA-2m77-r9w3-w44v
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
S:C reflects smuggling impact on other users' requests; C:L added as smuggled requests may expose cross-user data; AC:H retained for mandatory two-tier proxy architecture.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.
AnalysisAI
HTTP request smuggling in libsoup's header parsing enables unauthenticated remote attackers to inject malformed requests containing multiple conflicting Content-Length headers, potentially bypassing security controls or poisoning shared connection state in two-tier deployments. The flaw resides in soup_message_headers_append_common() within libsoup/soup-message-headers.c, which blindly appends header values without validating for duplicate or contradictory Content-Length fields - a direct violation of RFC 7230. No active exploitation has been confirmed (not in CISA KEV), EPSS stands at 0.03% (8th percentile), and SSVC rates exploitation as none with partial technical impact, placing this firmly in the low-urgency tier despite its network-accessible attack vector.
Technical ContextAI
libsoup is GNOME's HTTP client/server library, packaged across Red Hat Enterprise Linux 6 through 10 (cpe:2.3:a:red_hat:red_hat_enterprise_linux_*). The vulnerability originates in soup_message_headers_append_common() in libsoup/soup-message-headers.c, which appends every received header value without deduplicating or rejecting headers that carry conflicting semantic meaning. RFC 7230 §3.3.2 mandates that servers reject requests containing more than one Content-Length header with differing values as malformed. When libsoup silently accepts both, the length ambiguity creates an inconsistent interpretation between any upstream reverse proxy (which may honor the first Content-Length) and libsoup itself (which may honor the last). This is the classic CWE-444 (Inconsistent Interpretation of HTTP Requests - HTTP Request Smuggling) root cause: desynchronization between two HTTP processors parsing the same byte stream.
RemediationAI
An upstream fix has been submitted as GitLab merge request !513 at https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/513; however, no tagged patched release version has been independently confirmed from available data - monitor https://access.redhat.com/security/cve/CVE-2026-2708 and Red Hat Bugzilla #2440743 (https://bugzilla.redhat.com/show_bug.cgi?id=2440743) for RHEL package updates and apply them when published. As a compensating control for deployments where libsoup services sit behind a reverse proxy, configure the proxy to normalize or reject requests containing multiple Content-Length headers before forwarding - nginx's proxy_pass with default settings normalizes headers, while HAProxy can be configured with http-request deny if content-length header count gt 1; this introduces a small risk of rejecting edge-case legitimate traffic. If libsoup is used in a direct client-to-server capacity without an intermediary, the smuggling vector is unexploitable and no immediate action is required beyond applying the patch when available.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same weakness CWE-444 – HTTP Request/Response Smuggling
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today