CVE-2026-1801
published 2026-02-03CVE-2026-1801: A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the…
PriorityP338medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EPSS
0.43%
35.9th percentile
A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or user interaction by sending specially crafted chunked requests. This allows libsoup to parse and process multiple HTTP requests from a single network message, potentially leading to information disclosure.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libsoup2.4 | < libsoup3 3.6.5-8 (forky) | libsoup3 3.6.5-8 (forky) |
| debian | libsoup3 | < libsoup3 3.6.5-8 (forky) | libsoup3 3.6.5-8 (forky) |
| debian | libsoup3 | — | — |
| gnome | libsoup | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| ubuntu | libsoup2.4 | — | — |
| ubuntu | libsoup3 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
osv6.5MEDIUM
vendor_redhat6.5MEDIUM
vendor_debian5.3MEDIUM
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
libsoup vulnerabilities
vendor_ubuntu·2026-09-17·CVSS 5.3
CVE-2026-1801 [MEDIUM] libsoup vulnerabilities
Title: libsoup vulnerabilities
Summary: Several security issues were fixed in libsoup.
It was discovered that libsoup incorrectly handled certain URLs when
using an HTTP proxy. A remote attacker could possibly use this issue to
inject arbitrary HTTP headers. (CVE-2026-1467)
It was discovered that libsoup did not remove proxy authentication
credentials when following HTTP redirects. A remote attacker could
possibly use this issue to obtain sensitive information.
(CVE-2026-1539)
Ahmed Lekssays discovered that libsoup incorrectly parsed certain HTTP
requests. A remote attacker could possibly use this issue to obtain
sensitive information. (CVE-2026-1801)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
libsoup: libsoup: HTTP Request Smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked()
vendor_redhat·2026-06-05·CVSS 6.5
CVE-2026-66338 [MEDIUM] CWE-444 libsoup: libsoup: HTTP Request Smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked()
libsoup: libsoup: HTTP Request Smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked()
A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests.
Statement: A flaw was found in libsoup where the chunked transfer encoding parser uses strtoul() to parse chunk sizes without strict validation, silently accepting inputs that violate RFC 9112. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP req
Red Hat
libsoup: libsoup: HTTP Request Smuggling via malformed chunk headers
vendor_redhat·2026-02-03·CVSS 5.3
CVE-2026-1801 [MEDIUM] CWE-444 libsoup: libsoup: HTTP Request Smuggling via malformed chunk headers
libsoup: libsoup: HTTP Request Smuggling via malformed chunk headers
A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or user interaction by sending specially crafted chunked requests. This allows libsoup to parse and process multiple HTTP requests from a single network message, potentially leading to information disclosure.
A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-c
Debian
CVE-2026-1801: libsoup2.4 - A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Sm...
vendor_debian·2026·CVSS 5.3
CVE-2026-1801 [MEDIUM] CVE-2026-1801: libsoup2.4 - A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Sm...
A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or user interaction by sending specially crafted chunked requests. This allows libsoup to parse and process multiple HTTP requests from a single network message, potentially leading to information disclosure.
Scope: local
bookworm: open
bullseye: open
trixie: open
GHSA
GHSA-xv49-34rf-rqv4: A flaw was found in libsoup, an HTTP client/server library
ghsa_unreviewed·2026-02-03
CVE-2026-1801 [MEDIUM] CWE-444 GHSA-xv49-34rf-rqv4: A flaw was found in libsoup, an HTTP client/server library
A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or user interaction by sending specially crafted chunked requests. This allows libsoup to parse and process multiple HTTP requests from a single network message, potentially leading to information disclosure.
OSV
CVE-2026-1801: A flaw was found in libsoup, an HTTP client/server library
osv·2026-02-03·CVSS 6.5
CVE-2026-1801 [MEDIUM] CVE-2026-1801: A flaw was found in libsoup, an HTTP client/server library
A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or user interaction by sending specially crafted chunked requests. This allows libsoup to parse and process multiple HTTP requests from a single network message, potentially leading to information disclosure.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-1801 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2026-1801 [MEDIUM] CVE-2026-1801 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-1801 :
CBL Mariner vulnerability analysis and mitigation
A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or user interaction by sending specially crafted chunked requests. This allows libsoup to parse and process multiple HTTP requests from a single network message, potentially leading to information disclosure.
Source : NVD
## 6.5
Score
Published February 3, 2026
Severity MEDIUM
CNA Score 5.3
Affected Technologies
CBL Mari
Bugzilla
CVE-2026-103399 libsoup: SoupServer: HTTP/1 request smuggling via undrained Expect: 100-continue body [fedora-all]
bugzilla·2026-09-30·CVSS 5.3
CVE-2026-103399 [MEDIUM] CVE-2026-103399 libsoup: SoupServer: HTTP/1 request smuggling via undrained Expect: 100-continue body [fedora-all]
CVE-2026-103399 libsoup: SoupServer: HTTP/1 request smuggling via undrained Expect: 100-continue body [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
HTTP/1 request-smuggling desync in SoupServer: when a client sends Expect: 100-continue with a Content-Length body and SoupServer emits an early final (non-1xx) response before reading the body (e.g. 401 from SoupAuthDomain, or any handler that sets a final status at the headers stage), libsoup marks the read side DONE without draining the declared body bytes and without sending Connection: close. On a keep-alive connection those leftover body bytes are t
Bugzilla
CVE-2026-103399 libsoup: SoupServer: HTTP/1 request smuggling via undrained Expect: 100-continue body
bugzilla·2026-09-30·CVSS 5.3
CVE-2026-103399 [MEDIUM] CVE-2026-103399 libsoup: SoupServer: HTTP/1 request smuggling via undrained Expect: 100-continue body
CVE-2026-103399 libsoup: SoupServer: HTTP/1 request smuggling via undrained Expect: 100-continue body
HTTP/1 request-smuggling desync in SoupServer: when a client sends Expect: 100-continue with a Content-Length body and SoupServer emits an early final (non-1xx) response before reading the body (e.g. 401 from SoupAuthDomain, or any handler that sets a final status at the headers stage), libsoup marks the read side DONE without draining the declared body bytes and without sending Connection: close. On a keep-alive connection those leftover body bytes are then parsed as the next HTTP request, so a complete second request placed in the body is smuggled and executed (CWE-444 / RFC 9112 framing violation).
Verified upstream on libsoup 3.7.1 / current HEAD: one crafted connection to an auth-pr
Bugzilla
CVE-2026-103399 libsoup3: SoupServer: HTTP/1 request smuggling via undrained Expect: 100-continue body [fedora-all]
bugzilla·2026-09-30·CVSS 5.3
CVE-2026-103399 [MEDIUM] CVE-2026-103399 libsoup3: SoupServer: HTTP/1 request smuggling via undrained Expect: 100-continue body [fedora-all]
CVE-2026-103399 libsoup3: SoupServer: HTTP/1 request smuggling via undrained Expect: 100-continue body [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
HTTP/1 request-smuggling desync in SoupServer: when a client sends Expect: 100-continue with a Content-Length body and SoupServer emits an early final (non-1xx) response before reading the body (e.g. 401 from SoupAuthDomain, or any handler that sets a final status at the headers stage), libsoup marks the read side DONE without draining the declared body bytes and without sending Connection: close. On a keep-alive connection those leftover body bytes are
Bugzilla
CVE-2026-103399 mingw-libsoup: SoupServer: HTTP/1 request smuggling via undrained Expect: 100-continue body [fedora-all]
bugzilla·2026-09-30·CVSS 5.3
CVE-2026-103399 [MEDIUM] CVE-2026-103399 mingw-libsoup: SoupServer: HTTP/1 request smuggling via undrained Expect: 100-continue body [fedora-all]
CVE-2026-103399 mingw-libsoup: SoupServer: HTTP/1 request smuggling via undrained Expect: 100-continue body [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
HTTP/1 request-smuggling desync in SoupServer: when a client sends Expect: 100-continue with a Content-Length body and SoupServer emits an early final (non-1xx) response before reading the body (e.g. 401 from SoupAuthDomain, or any handler that sets a final status at the headers stage), libsoup marks the read side DONE without draining the declared body bytes and without sending Connection: close. On a keep-alive connection those leftover body bytes
Bugzilla
CVE-2026-66338 libsoup: libsoup: HTTP Request Smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked()
bugzilla·2026-07-24·CVSS 6.5
CVE-2026-66338 [MEDIUM] CVE-2026-66338 libsoup: libsoup: HTTP Request Smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked()
CVE-2026-66338 libsoup: libsoup: HTTP Request Smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked()
The chunked transfer encoding parser in libsoup uses strtoul(metabuf, NULL, 16) to parse chunk sizes without strict validation. This function silently accepts inputs that violate RFC 9112 §7.1, including leading whitespace, + prefixes, and trailing invalid characters (e.g., 0z parses as 0). When libsoup operates behind a strict frontend proxy, this parsing differential enables an attacker to smuggle HTTP requests through the backend connection. Both server-side (SoupServer) and client-side chunked response parsing are affected. This is distinct from CVE-2026-1801 which covers bare LF tolerance.
Upstream report: https://gitlab.gnome.org/GNOME/libsoup/-/work_it
Bugzilla
CVE-2026-1801 libsoup: libsoup: HTTP Request Smuggling via malformed chunk headers
bugzilla·2026-02-03·CVSS 6.5
CVE-2026-1801 [MEDIUM] CVE-2026-1801 libsoup: libsoup: HTTP Request Smuggling via malformed chunk headers
CVE-2026-1801 libsoup: libsoup: HTTP Request Smuggling via malformed chunk headers
HTTP Request Smuggling vulnerability in the chunked transfer encoding parser of the libsoup HTTP library. The flaw is caused by non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts lone LF (\n) characters and other malformed chunk headers instead of enforcing CRLF (\r\n) as required by RFC 9112. When a malicious HTTP client sends specially crafted chunked requests, libsoup may parse and process multiple HTTP requests from a single network message. Although exploitation is possible remotely without authentication or user interaction, the impact is limited because SoupServer is not commonly used in internet-facing infrastructure.
Bugzilla
CVE-2026-1801 mingw-libsoup: libsoup: HTTP Request Smuggling via malformed chunk headers [fedora-all]
bugzilla·2026-02-03·CVSS 6.5
CVE-2026-1801 [MEDIUM] CVE-2026-1801 mingw-libsoup: libsoup: HTTP Request Smuggling via malformed chunk headers [fedora-all]
CVE-2026-1801 mingw-libsoup: libsoup: HTTP Request Smuggling via malformed chunk headers [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
2026-02-03
Published