Executive brief
libsoup is a widely used networking library that helps applications communicate over the internet. A flaw in how it handles data transfers allows attackers to hide malicious commands inside legitimate-looking web traffic. This can lead to unauthorized access to data or the ability to bypass security filters when the library is used behind a web proxy.
Technical details
A vulnerability (CWE-444) exists in libsoup's soup_body_input_stream_read_chunked() function due to the use of strtoul() for parsing chunk sizes. This implementation silently accepts inputs that violate RFC 9112, such as leading whitespace, plus sign prefixes, and trailing invalid characters. An attacker can exploit the parsing differential between a strict frontend proxy and the permissive libsoup backend to smuggle HTTP requests. This affects both SoupServer and client-side response parsing. The issue is distinct from previous vulnerabilities related to line-ending (LF) tolerance.
Affected products
- Red Hat libsoup3 Enterprise Linux 10
- Red Hat libsoup Enterprise Linux 6, 7, 8, 9
- GNOME libsoup
Timeline
- 2026-07-24: disclosed: Initial vulnerability report and CVE assignment
- 2026-07-24: advisory: Red Hat published security details for REL products