UBUNTU-CVE-2026-103399: Medium severity ubuntu/libsoup2.4 vulnerability
A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled request, leading to unintended request handling.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using SoupServer in ubuntu/libsoup2.4 or ubuntu/libsoup3 are affected when they accept HTTP/1.x keep-alive connections. Exploitation specifically depends on handling requests with Expect: 100-continue and a request body, followed by an early final non-1xx response before that body is read.
Does an attacker need credentials or user interaction?
No. The issue is remotely exploitable by an unauthenticated attacker and does not require user interaction.
What must an attacker send to exploit the flaw?
The attacker must send an HTTP/1.x request with Expect: 100-continue and a declared request body, then place a complete HTTP request within the unread body bytes. If the server sends an early final response without draining the body or closing the connection, it can process those bytes as a new request on the keep-alive connection.
What is the practical impact?
An attacker can cause SoupServer to process a smuggled request that was embedded in the prior request body. This can result in unintended request handling, with integrity impact indicated as low.