https://gitlab.gnome.org/GNOME/libsoup/-/workitems/506 https://redhat.atlassian.net/browse/PSIRTSUPT-8846
Integer Overflow or Wraparound vulnerability in the cookie parsing logic of the libsoup HTTP client/server library. This issue potentially allows improper handling of cookie expiration dates due to an integer overflow when processing excessively large values. The vulnerability arises from insufficient validation in the conversion logic of cookie expiration timestamps, which can result in undefined behavior. This may enable an attacker to craft malicious cookies that never expire or behave unpredictably, impacting session management and security policies in applications relying on libsoup
HTTP Request Smuggling vulnerability in the chunked transfer encoding parser of the libsoup HTTP library. The flaw is caused by non-RFC-compliant parsing in the soupfilterinputstreamreadline() logic, where libsoup accepts lone LF (\n) characters and other malformed chunk headers instead of enforcing CRLF (\r\n) as required by RFC 9112. When a malicious HTTP client sends specially crafted chunked requests, libsoup may parse and process multiple HTTP requests from a single network message. Although exploitation is possible remotely without authentication or user interaction, the impact is limited because SoupServer is not commonly used in internet-facing infrastructure.
The chunked transfer encoding parser in libsoup uses strtoul(metabuf, NULL, 16) to parse chunk sizes without strict validation. This function silently accepts inputs that violate RFC 9112 §7.1, including leading whitespace, + prefixes, and trailing invalid characters (e.g., 0z parses as 0). When libsoup operates behind a strict frontend proxy, this parsing differential enables an attacker to smuggle HTTP requests through the backend connection. Both server-side (SoupServer) and client-side chunked response parsing are affected. This is distinct from CVE-2026-1801 which covers bare LF tolerance.
Upstream report: https://gitlab.gnome.org/GNOME/libsoup/-/workitems/533 PSIRTSUPT: https://redhat.atlassian.net/browse/PSIRTSUPT-17666