EUVD-2026-25306
GHSA-2m77-r9w3-w44v
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
S:C reflects smuggling impact on other users' requests; C:L added as smuggled requests may expose cross-user data; AC:H retained for mandatory two-tier proxy architecture.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.
AnalysisAI
HTTP request smuggling in libsoup's header parsing enables unauthenticated remote attackers to inject malformed requests containing multiple conflicting Content-Length headers, potentially bypassing security controls or poisoning shared connection state in two-tier deployments. The flaw resides in soup_message_headers_append_common() within libsoup/soup-message-headers.c, which blindly appends header values without validating for duplicate or contradictory Content-Length fields - a direct violation of RFC 7230. No active exploitation has been confirmed (not in CISA KEV), EPSS stands at 0.03% (8th percentile), and SSVC rates exploitation as none with partial technical impact, placing this firmly in the low-urgency tier despite its network-accessible attack vector.
Technical ContextAI
libsoup is GNOME's HTTP client/server library, packaged across Red Hat Enterprise Linux 6 through 10 (cpe:2.3:a:red_hat:red_hat_enterprise_linux_*). The vulnerability originates in soup_message_headers_append_common() in libsoup/soup-message-headers.c, which appends every received header value without deduplicating or rejecting headers that carry conflicting semantic meaning. RFC 7230 §3.3.2 mandates that servers reject requests containing more than one Content-Length header with differing values as malformed. When libsoup silently accepts both, the length ambiguity creates an inconsistent interpretation between any upstream reverse proxy (which may honor the first Content-Length) and libsoup itself (which may honor the last). This is the classic CWE-444 (Inconsistent Interpretation of HTTP Requests - HTTP Request Smuggling) root cause: desynchronization between two HTTP processors parsing the same byte stream.
RemediationAI
An upstream fix has been submitted as GitLab merge request !513 at https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/513; however, no tagged patched release version has been independently confirmed from available data - monitor https://access.redhat.com/security/cve/CVE-2026-2708 and Red Hat Bugzilla #2440743 (https://bugzilla.redhat.com/show_bug.cgi?id=2440743) for RHEL package updates and apply them when published. As a compensating control for deployments where libsoup services sit behind a reverse proxy, configure the proxy to normalize or reject requests containing multiple Content-Length headers before forwarding - nginx's proxy_pass with default settings normalizes headers, while HAProxy can be configured with http-request deny if content-length header count gt 1; this introduces a small risk of rejecting edge-case legitimate traffic. If libsoup is used in a direct client-to-server capacity without an intermediary, the smuggling vector is unexploitable and no immediate action is required beyond applying the patch when available.
More in Red Hat Enterprise Linux 10
View allRemote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co
Privilege escalation via authentication bypass in libssh affects servers that enable GSSAPIKeyExchange, where the gssapi
Same weakness CWE-444 – HTTP Request/Response Smuggling
View allSame technique Request Smuggling
View allShare
External POC / Exploit Code
Leaving vuln.today