A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.
CVSS Details
- CVSS 3.1 Base Score: 3.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade libsoup3-debugsourceUpgrade libsoup3-debuginfoUpgrade libsoup3Upgrade libsoup3-develUpgrade libsoup3-doc | Jun 9, 2026 | Feb 18, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Feb 18, 2026 |
| Suse | — | Upgrade libsoup2-devel-32bitUpgrade libsoup-2_4-1-32bitUpgrade libsoup-develUpgrade libsoup-langUpgrade libsoup-3_0-0Upgrade typelib-1_0-Soup-3_0Upgrade libsoup2-develUpgrade typelib-1_0-Soup-2_4Upgrade libsoup-devel-32bitUpgrade libsoup-3_0-0-32bitUpgrade libsoup-2_4-1Upgrade libsoup2-lang | Feb 27, 2026 | Feb 27, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub