REDHAT-BUG-2436315: Low severity Gnome libsoup vulnerability

Published Feb 3, 2026
·
Updated

HTTP Request Smuggling vulnerability in the chunked transfer encoding parser of the libsoup HTTP library. The flaw is caused by non-RFC-compliant parsing in the soupfilterinputstreamreadline() logic, where libsoup accepts lone LF (\n) characters and other malformed chunk headers instead of enforcing CRLF (\r\n) as required by RFC 9112. When a malicious HTTP client sends specially crafted chunked requests, libsoup may parse and process multiple HTTP requests from a single network message. Although exploitation is possible remotely without authentication or user interaction, the impact is limited because SoupServer is not commonly used in internet-facing infrastructure.

Affected Software

1 affected component
Gnome libsoup

Event History

Feb 3, 2026
Data Sourced
via Red Hat·12:46 PM
DescriptionSeverityAffected Software

Frequently Asked Questions

1

What is the severity of REDHAT-BUG-2436315?

The severity of REDHAT-BUG-2436315 is classified as critical due to its potential to allow HTTP request smuggling attacks.

2

How do I fix REDHAT-BUG-2436315?

To fix REDHAT-BUG-2436315, update libsoup to a version that addresses the chunked transfer encoding parser vulnerability.

3

What software is affected by REDHAT-BUG-2436315?

REDHAT-BUG-2436315 affects applications utilizing the libsoup HTTP library that do not conform to RFC specifications.

4

What threats does REDHAT-BUG-2436315 pose?

REDHAT-BUG-2436315 poses threats such as HTTP request smuggling, which can lead to unauthorized access or manipulation of web traffic.

5

Where can I find more information about REDHAT-BUG-2436315?

More information about REDHAT-BUG-2436315 can be found on the Red Hat Bugzilla page.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203