REDHAT-BUG-2436315: Low severity Gnome libsoup vulnerability
HTTP Request Smuggling vulnerability in the chunked transfer encoding parser of the libsoup HTTP library. The flaw is caused by non-RFC-compliant parsing in the soupfilterinputstreamreadline() logic, where libsoup accepts lone LF (\n) characters and other malformed chunk headers instead of enforcing CRLF (\r\n) as required by RFC 9112. When a malicious HTTP client sends specially crafted chunked requests, libsoup may parse and process multiple HTTP requests from a single network message. Although exploitation is possible remotely without authentication or user interaction, the impact is limited because SoupServer is not commonly used in internet-facing infrastructure.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2436315?
The severity of REDHAT-BUG-2436315 is classified as critical due to its potential to allow HTTP request smuggling attacks.
How do I fix REDHAT-BUG-2436315?
To fix REDHAT-BUG-2436315, update libsoup to a version that addresses the chunked transfer encoding parser vulnerability.
What software is affected by REDHAT-BUG-2436315?
REDHAT-BUG-2436315 affects applications utilizing the libsoup HTTP library that do not conform to RFC specifications.
What threats does REDHAT-BUG-2436315 pose?
REDHAT-BUG-2436315 poses threats such as HTTP request smuggling, which can lead to unauthorized access or manipulation of web traffic.
Where can I find more information about REDHAT-BUG-2436315?
More information about REDHAT-BUG-2436315 can be found on the Red Hat Bugzilla page.