medium5.3
CVE-2026-1801
A flaw was found in libsoup, an HTTP client/server library.
Impact
A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or user interaction by sending specially crafted chunked requests. This allows libsoup to parse and process multiple HTTP requests from a single network message, potentially leading to information disclosure.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gnome | Libsoup | All versions |
| Redhat | Enterprise Linux | Versions 6.0, 7.0, 8.0, 9.0, 10.0 |