A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the backend interprets it as destined for another host. This discrepancy enables request-smuggling style attacks, cache poisoning, or bypassing host-based access controls when an attacker supplies duplicate Host headers.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libsoup-develUpgrade libsoup | Jan 20, 2026 | Jan 12, 2026 |
| Amazon Linux Ami 2 | — | Upgrade libsoup-develUpgrade libsoupUpgrade libsoup-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade libsoup3Upgrade libsoup-docUpgrade libsoupUpgrade libsoup3-debugsourceUpgrade libsoup-develUpgrade libsoup3-debuginfoUpgrade libsoup3-develUpgrade libsoup3-docUpgrade libsoup-debugsourceUpgrade libsoup-debuginfo | Feb 10, 2026 | Dec 11, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libsoup-helpUpgrade libsoup | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libsoupUpgrade libsoup-help | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libsoupUpgrade libsoup-help | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade libsoupUpgrade libsoup-help | Mar 10, 2026 | Mar 10, 2026 |
| Oracle_linux | — | Upgrade libsoup3-develUpgrade libsoup3Upgrade libsoup3-docUpgrade libsoup-develUpgrade libsoup | Jan 15, 2026 | Dec 11, 2025 |
| Redhat_linux | — | Upgrade libsoup3-debuginfoUpgrade libsoup3-develUpgrade libsoup-debuginfoUpgrade spice-client-win-x86No solution existsUpgrade libsoup3-docUpgrade libsoup-debugsourceUpgrade libsoup3-debugsourceUpgrade spice-client-win-x64Upgrade libsoup-develUpgrade libsoup3Upgrade libsoup | Jan 15, 2026 | Dec 11, 2025 |
| Rocky_linux | — | Upgrade libsoup3-debuginfoUpgrade libsoupUpgrade libsoup3Upgrade libsoup-debuginfoUpgrade libsoup3-develUpgrade libsoup-debugsourceUpgrade libsoup3-debugsourceUpgrade libsoup-devel | Jan 16, 2026 | Jan 15, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub