CVE-2026-66338: Libsoup: libsoup: http request smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked()
A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests.
Other sources
The chunked transfer encoding parser in libsoup uses strtoul(metabuf, NULL, 16) to parse chunk sizes without strict validation. This function silently accepts inputs that violate RFC 9112 §7.1, including leading whitespace, + prefixes, and trailing invalid characters (e.g., 0z parses as 0). When libsoup operates behind a strict frontend proxy, this parsing differential enables an attacker to smuggle HTTP requests through the backend connection. Both server-side (SoupServer) and client-side chunked response parsing are affected. This is distinct from CVE-2026-1801 which covers bare LF tolerance.
Upstream report: https://gitlab.gnome.org/GNOME/libsoup/-/workitems/533 PSIRTSUPT: https://redhat.atlassian.net/browse/PSIRTSUPT-17666
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66338?
The severity of CVE-2026-66338 is medium with a CVSS score of 5.4.
How does CVE-2026-66338 affect libsoup?
CVE-2026-66338 allows for HTTP request smuggling due to permissive chunk-size parsing in libsoup.
How do I fix CVE-2026-66338?
To fix CVE-2026-66338, ensure you are using an updated version of libsoup that addresses this vulnerability.
What systems are impacted by CVE-2026-66338?
CVE-2026-66338 impacts any systems utilizing libsoup that are susceptible to improper chunked transfer encoding parsing.
What type of attacks can CVE-2026-66338 facilitate?
CVE-2026-66338 can facilitate HTTP request smuggling attacks, compromising the integrity of web applications.