Executive brief
libsoup is a widely used software library that helps applications communicate over the internet. A flaw in how it handles web requests allows an attacker to send conflicting information about which website they are trying to reach. This can trick security filters and web proxies into sending traffic to the wrong destination, potentially allowing unauthorized access to restricted data or the corruption of web caches.
Technical details
A vulnerability exists in libsoup's HTTP header parsing logic where the library incorrectly handles multiple 'Host' headers by prioritizing the last occurrence. This behavior creates a discrepancy when libsoup is used behind front-end proxies or load balancers that typically honor only the first 'Host' header. An unauthenticated remote attacker can exploit this inconsistency to perform HTTP request smuggling, virtual host (vhost) confusion, or web cache poisoning. By supplying duplicate Host headers, attackers may bypass host-based access controls or route requests to unintended backend services. Red Hat has released security updates (e.g., RHSA-2026:0421, RHSA-2026:0422) to address this issue across various RHEL versions.
Affected products
- GNOME libsoup 2.x, 3.x
- Red Hat Red Hat Enterprise Linux 7 libsoup-2.62.2-10.el7_9
- Red Hat Red Hat Enterprise Linux 8 libsoup-2.62.3-11.el8_10
- Red Hat Red Hat Enterprise Linux 9 libsoup-2.72.0-12.el9_7.3
- Red Hat Red Hat Enterprise Linux 10 libsoup3-3.6.5-3.el10_1.8
Timeline
- 2025-12-11: disclosed
- 2026-01-12: patched: Red Hat released initial security advisories.
References
- https://access.redhat.com/downloads/content/package-browser/
- https://access.redhat.com/errata/RHSA-2026:0421
- https://access.redhat.com/errata/RHSA-2026:0422
- https://access.redhat.com/errata/RHSA-2026:0423
- https://access.redhat.com/errata/RHSA-2026:0836
- https://access.redhat.com/errata/RHSA-2026:0867
- https://access.redhat.com/errata/RHSA-2026:0868