Is CVE-2026-66338 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66338 being exploited in the wild.

How severe is CVE-2026-66338?

Medium severity, with a CVSS score of 5.4, published 24 July 2026.

Which products and versions are affected?

Gnome Libsoup Enterprise Linux 10.

Is there a fix for CVE-2026-66338?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-66338 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-66338?

Check whether you run Gnome Libsoup at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66338: GNOME libsoup HTTP request smuggling in chunked transfer encoding parser

CVE-2026-66338 · Severity: medium · CVSS 5.4 · Published 2026-07-24

libsoup is a widely used networking library that helps applications communicate over the internet. A flaw in how it handles data transfers allows attackers to hide malicious commands inside legitimate-looking web traffic. This can lead to unauthorized access to data or the ability to bypass security filters when the library is used behind a web proxy.

Technologies: Gnome Libsoup. Vendors: Gnome.

Quick answers

Is CVE-2026-66338 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66338 being exploited in the wild.
How severe is CVE-2026-66338?: Medium severity, with a CVSS score of 5.4, published 24 July 2026.
Which products and versions are affected?: Gnome Libsoup Enterprise Linux 10.
Is there a fix for CVE-2026-66338?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-66338 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-66338?: Check whether you run Gnome Libsoup at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability (CWE-444) exists in libsoup's soup_body_input_stream_read_chunked() function due to the use of strtoul() for parsing chunk sizes. This implementation silently accepts inputs that violate RFC 9112, such as leading whitespace, plus sign prefixes, and trailing invalid characters. An attacker can exploit the parsing differential between a strict frontend proxy and the permissive libsoup backend to smuggle HTTP requests. This affects both SoupServer and client-side response parsing. The issue is distinct from previous vulnerabilities related to line-ending (LF) tolerance.

Affected products

Red Hat libsoup3 Enterprise Linux 10
Red Hat libsoup Enterprise Linux 6, 7, 8, 9
GNOME libsoup

Timeline

2026-07-24: disclosed: Initial vulnerability report and CVE assignment
2026-07-24: advisory: Red Hat published security details for REL products

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.