CVE-2026-6324: Libsoup: libsoup: http request smuggling via unsigned to signed conversion error
A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soupbodyinputstreamreadchunked() function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.
Other sources
HTTP Request Smuggling on libsoup through libsoup/http1/soup-body-input-stream.c:soupbodyinputstreamreadchunked() via Unsigned to Signed Conversion Error in chunk size
Requirements to exploit: spend malicious HTTP request to libsoup backend server operating behind non-libsoup proxy server, or to libsoup proxy server operating in front of non-libsoup backend server
— Red Hat
Libsoup: libsoup: http request smuggling via unsigned to signed conversion error
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.4.4-16
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6324?
The severity of CVE-2026-6324 is rated as medium with a score of 4.8.
How can I fix CVE-2026-6324?
To fix CVE-2026-6324, update to a patched version of libsoup that addresses the unsigned to signed conversion error.
What types of systems are affected by CVE-2026-6324?
CVE-2026-6324 affects systems running Gnome libsoup and Microsoft azl3 libsoup version 3.4.4-15.
What is the risk associated with CVE-2026-6324?
The risk associated with CVE-2026-6324 is categorized as medium, allowing remote code execution through manipulated HTTP requests.
How does CVE-2026-6324 exploit occur?
CVE-2026-6324 exploit occurs due to an unsigned to signed conversion error when libsoup processes HTTP requests via a non-libsoup proxy.