REDHAT-BUG-2506950: Low severity Gnome libsoup vulnerability
The chunked transfer encoding parser in libsoup uses strtoul(metabuf, NULL, 16) to parse chunk sizes without strict validation. This function silently accepts inputs that violate RFC 9112 §7.1, including leading whitespace, + prefixes, and trailing invalid characters (e.g., 0z parses as 0). When libsoup operates behind a strict frontend proxy, this parsing differential enables an attacker to smuggle HTTP requests through the backend connection. Both server-side (SoupServer) and client-side chunked response parsing are affected. This is distinct from CVE-2026-1801 which covers bare LF tolerance.
Upstream report: https://gitlab.gnome.org/GNOME/libsoup/-/workitems/533 PSIRTSUPT: https://redhat.atlassian.net/browse/PSIRTSUPT-17666
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Deploy/use a strict frontend proxy that enforces RFC 9112 §7.1 chunk-size syntax (reject chunk-size values with leading whitespace, a leading '+' prefix, and any trailing invalid characters) so that malformed chunk sizes cannot be interpreted by the backend libsoup parser.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2506950?
The severity of REDHAT-BUG-2506950 is classified as low.
How do I fix REDHAT-BUG-2506950?
To fix REDHAT-BUG-2506950, update to the latest version of libsoup that addresses this vulnerability.
What components are affected by REDHAT-BUG-2506950?
REDHAT-BUG-2506950 affects the Gnome libsoup library, including SoupServer and SoupClient.
What is the nature of the issue in REDHAT-BUG-2506950?
The issue in REDHAT-BUG-2506950 involves improper parsing of chunk sizes in the chunked transfer encoding that allows violation of RFC 9112.
When was REDHAT-BUG-2506950 published?
REDHAT-BUG-2506950 was published on July 24, 2026.