CVE-2026-1801: Libsoup: libsoup: http request smuggling via malformed chunk headers
A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soupfilterinputstreamreadline() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or user interaction by sending specially crafted chunked requests. This allows libsoup to parse and process multiple HTTP requests from a single network message, potentially leading to information disclosure.
Other sources
HTTP Request Smuggling vulnerability in the chunked transfer encoding parser of the libsoup HTTP library. The flaw is caused by non-RFC-compliant parsing in the soupfilterinputstreamreadline() logic, where libsoup accepts lone LF (\n) characters and other malformed chunk headers instead of enforcing CRLF (\r\n) as required by RFC 9112. When a malicious HTTP client sends specially crafted chunked requests, libsoup may parse and process multiple HTTP requests from a single network message. Although exploitation is possible remotely without authentication or user interaction, the impact is limited because SoupServer is not commonly used in internet-facing infrastructure.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1801?
CVE-2026-1801 is considered a critical severity vulnerability due to its potential impact on HTTP request smuggling.
How do I fix CVE-2026-1801?
To fix CVE-2026-1801, update to the latest version of libsoup that addresses this HTTP request smuggling vulnerability.
What systems are affected by CVE-2026-1801?
CVE-2026-1801 specifically affects the libsoup library used in various applications that implement HTTP client/server functionality.
What is the impact of CVE-2026-1801?
The impact of CVE-2026-1801 includes risks of HTTP request smuggling attacks, leading to unauthorized data access or manipulation.
How does CVE-2026-1801 exploit malformed chunk headers?
CVE-2026-1801 exploits malformed chunk headers due to non-RFC-compliant parsing within the libsoup's logic, allowing attackers to send malicious requests.