SUSE-SU-2026:5063-1: Security update for libsoup
This update for libsoup fixes the following issue:
- CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling (bsc#1283831).
Other sources
This update for libsoup fixes the following issue: CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling (bsc#1283831).
— SUSE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/libsoupto a version that resolves this vulnerability.Fixed in 3.0.4-150400.3.58.1 - Upgrade
Upgrade
suse/typelibto a version that resolves this vulnerability.Fixed in 1_0-Soup-3_0-3.0.4-150400.3.58.1 - Upgrade
Upgrade
suse/libsoupto a version that resolves this vulnerability.Fixed in 3_0-0-3.0.4-150400.3.58.1 - Upgrade
Upgrade
suse/libsoup-debugsourceto a version that resolves this vulnerability.Fixed in 3.0.4-150400.3.58.1 - Upgrade
Upgrade
suse/libsoupto a version that resolves this vulnerability.Fixed in 3_0-0-debuginfo-3.0.4-150400.3.58.1 - Upgrade
Upgrade
suse/libsoup-develto a version that resolves this vulnerability.Fixed in 3.0.4-150400.3.58.1 - Upgrade
Upgrade
suse/libsoup-langto a version that resolves this vulnerability.Fixed in 3.0.4-150400.3.58.1 - Upgrade
Upgrade
suse/libsoupto a version that resolves this vulnerability.Fixed in 3_0-0-32bit-3.0.4-150400.3.58.1 - Upgrade
Upgrade
suse/libsoupto a version that resolves this vulnerability.Fixed in 3_0-0-32bit-debuginfo-3.0.4-150400.3.58.1 - Upgrade
Upgrade
suse/libsoup-develto a version that resolves this vulnerability.Fixed in 32bit-3.0.4-150400.3.58.1 - Upgrade
Upgrade
suse/libsoupto a version that resolves this vulnerability.Fixed in 3_0-0-64bit-debuginfo-3.0.4-150400.3.58.1 - Upgrade
Upgrade
suse/libsoupto a version that resolves this vulnerability.Fixed in 3_0-0-64bit-3.0.4-150400.3.58.1 - Upgrade
Upgrade
suse/libsoup-develto a version that resolves this vulnerability.Fixed in 64bit-3.0.4-150400.3.58.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-2026-5063 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-5063 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-5063 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-5063 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-5063 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-5063 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-5063 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-5063 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-5063
Event History
Frequently Asked Questions
Which deployments are explicitly covered by this update?
The listed affected products include libsoup and related packages on SUSE Linux Enterprise Server for SAP Applications 15 SP4 for ppc64le and x86_64, and SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 for aarch64 and x86_64. The update also lists libsoup-devel, typelib, libsoup-debugsource, and libsoup-lang.
What type of traffic and behavior are involved in exploitation?
The issue concerns HTTP/1.x early responses where request bodies are not completely drained. This condition can enable HTTP request smuggling.
What should be prioritized for remediation?
Apply the SUSE security update for libsoup to affected systems. The provided data does not specify an alternative mitigation if patching cannot be performed immediately.