A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the backend interprets it as destined for another host. This discrepancy enables request-smuggling style attacks, cache poisoning, or bypassing host-based access controls when an attacker supplies duplicate Host headers.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libsoup-develUpgrade libsoup | Jan 20, 2026 | Jan 12, 2026 |
| Amazon Linux Ami 2 | — | Upgrade libsoup-debuginfoUpgrade libsoupUpgrade libsoup-devel | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade libsoup3-debugsourceUpgrade libsoup-develUpgrade libsoup-docUpgrade libsoup3Upgrade libsoup3-debuginfoUpgrade libsoupUpgrade libsoup-debuginfoUpgrade libsoup-debugsourceUpgrade libsoup3-docUpgrade libsoup3-devel | Feb 10, 2026 | Dec 11, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libsoupUpgrade libsoup-help | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libsoup-helpUpgrade libsoup | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libsoupUpgrade libsoup-help | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade libsoupUpgrade libsoup-help | Mar 10, 2026 | Mar 10, 2026 |
| Oracle_linux | — | Upgrade libsoup3-develUpgrade libsoup3Upgrade libsoup-develUpgrade libsoupUpgrade libsoup3-doc | Jan 15, 2026 | Dec 11, 2025 |
| Redhat_linux | — | Upgrade libsoup3-debugsourceUpgrade spice-client-win-x64Upgrade libsoup-develUpgrade libsoupUpgrade libsoup3Upgrade libsoup3-docUpgrade libsoup3-develUpgrade libsoup-debugsourceUpgrade libsoup3-debuginfoUpgrade spice-client-win-x86Upgrade libsoup-debuginfoNo solution exists | Jan 15, 2026 | Dec 11, 2025 |
| Rocky_linux | — | Upgrade libsoup-debuginfoUpgrade libsoup3-develUpgrade libsoupUpgrade libsoup3Upgrade libsoup3-debuginfoUpgrade libsoup3-debugsourceUpgrade libsoup-debugsourceUpgrade libsoup-devel | Jan 16, 2026 | Jan 15, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub