CVE-2026-2708: Libsoup: libsoup: http request smuggling via duplicate content-length headers
A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soupmessageheadersappendcommon() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.
Other sources
Libsoup: libsoup: http request smuggling via duplicate content-length headers
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.4.4-16
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2708?
CVE-2026-2708 is classified as a moderate severity vulnerability.
How do I fix CVE-2026-2708?
To mitigate CVE-2026-2708, update to the latest version of libsoup that includes the fix for this vulnerability.
What impact does CVE-2026-2708 have on my applications?
CVE-2026-2708 can lead to HTTP request smuggling attacks, potentially allowing an attacker to bypass security measures.
Which versions of libsoup are affected by CVE-2026-2708?
CVE-2026-2708 affects all versions of libsoup prior to the patched version that addresses this vulnerability.
Is CVE-2026-2708 exploitable remotely?
Yes, CVE-2026-2708 is exploitable remotely, making it a concern for web applications using libsoup.