A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.
CVSS Details
- CVSS 3.1 Base Score: 3.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade libsoup3-develUpgrade libsoup3-docUpgrade libsoup3Upgrade libsoup3-debuginfoUpgrade libsoup3-debugsource | Jun 9, 2026 | Feb 18, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Feb 18, 2026 |
| Suse | — | Upgrade libsoup-3_0-0Upgrade libsoup-develUpgrade libsoup-2_4-1-32bitUpgrade libsoup-langUpgrade libsoup2-devel-32bitUpgrade typelib-1_0-Soup-3_0Upgrade libsoup-devel-32bitUpgrade typelib-1_0-Soup-2_4Upgrade libsoup-3_0-0-32bitUpgrade libsoup-2_4-1Upgrade libsoup2-develUpgrade libsoup2-lang | Feb 27, 2026 | Feb 27, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub