# CVE-2026-6324: GNOME libsoup HTTP request smuggling in soup_body_input_stream_read_chunked

Source: https://junglewise.ai/threats/cve-2026-6324-gnome-libsoup-http-request-smuggling-in-soup-body-input-stream  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-6324 · Severity: medium · CVSS 4.8 · Published 2026-05-29

A vulnerability in the libsoup networking library can allow attackers to perform "HTTP Request Smuggling" attacks. By sending a specially crafted web request, an attacker can trick a server into misinterpreting where one request ends and the next begins. This can lead to unauthorized access, the bypassing of security controls, or the poisoning of web caches, potentially affecting any application using libsoup in a proxy or backend server configuration.

Technologies: [Gnome Libsoup](https://junglewise.ai/threats/technologies/libsoup). Vendors: [Gnome](https://junglewise.ai/threats/vendors/gnome).

## Quick answers

**Is CVE-2026-6324 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6324 being exploited in the wild.

**How severe is CVE-2026-6324?** Medium severity, with a CVSS score of 4.8, published 29 May 2026.

**Which products and versions are affected?** Gnome Libsoup 3.7.0.

**Is there a fix for CVE-2026-6324?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-6324 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-6324?** Check whether you run Gnome Libsoup at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unsigned-to-signed conversion error exists in the `soup_body_input_stream_read_chunked()` function within `libsoup/http1/soup-body-input-stream.c`. The library parses the HTTP chunk size using `strtoul()` (unsigned) but stores the result in a `goffset` (signed 64-bit) variable. If an attacker provides a chunk size where the most significant bit is set (e.g., ≥ 2^63), the value is interpreted as negative. The state machine treats a non-positive `read_length` as the end of the message body, causing subsequent data on the same keep-alive connection to be interpreted as a new, smuggled HTTP request. This vulnerability is primarily exploitable when libsoup is used in conjunction with another proxy or backend that interprets the chunk size differently.

## Affected products

- GNOME libsoup 3.7.0

## Timeline

- 2026-01-27: disclosed: Reported via YesWeHack
- 2026-05-29: advisory: CVE published by Red Hat

## References

- [https://access.redhat.com/security/cve/CVE-2026-6324](https://access.redhat.com/security/cve/CVE-2026-6324)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2458479](https://bugzilla.redhat.com/show_bug.cgi?id=2458479)
- [https://gitlab.gnome.org/GNOME/libsoup/-/issues/508](https://gitlab.gnome.org/GNOME/libsoup/-/issues/508)

## Related threats

- [libsoup HTTP request smuggling via undrained Expect: 100-continue body](https://junglewise.ai/threats/cve-2026-103399-a-flaw-was-found-in-soupserver-libsoup-when-an-http-1-x-client)
- [libsoup heap buffer overflow in permessage-deflate WebSocket extension](https://junglewise.ai/threats/cve-2026-102560-a-flaw-was-found-in-libsoup-when-the-permessage-deflate)
- [libsoup heap buffer overflow in WebSocket handling](https://junglewise.ai/threats/cve-2026-102558-a-flaw-was-found-in-libsoup-when-max-incoming-payload-size-is)
- [libsoup out-of-bounds read in data-URI base64 decoding](https://junglewise.ai/threats/cve-2026-102555-a-flaw-was-found-in-libsoup-the-soup-uri-decode-data-uri)
- [libsoup heap corruption in WebSocket message reassembly](https://junglewise.ai/threats/cve-2026-102557-a-flaw-was-found-in-libsoup-when-reassembling-fragmented)