CVE-2024-52530 — HTTP Request Smuggling in Libsoup
Severity
7.5HIGHNVD
EPSS
0.4%
top 41.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedNov 11
Latest updateNov 27
Description
GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is treated the same as a "Transfer-Encoding: chunked" header.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6
Affected Packages1 packages
🔴Vulnerability Details
6📋Vendor Advisories
5Microsoft
â–¶
Red Hat
â–¶
Debianâ–¶
CVE-2024-52530: libsoup2.4 - GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations ...↗2024