VYPR
Unrated severityNVD Advisory· Published Feb 3, 2026· Updated Mar 26, 2026

Libsoup: libsoup: http request smuggling via malformed chunk headers

CVE-2026-1801

Description

A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or user interaction by sending specially crafted chunked requests. This allows libsoup to parse and process multiple HTTP requests from a single network message, potentially leading to information disclosure.

Affected products

6
  • Red Hat/Red Hat Enterprise Linux 10v5
    cpe:/o:redhat:enterprise_linux:10
  • Red Hat/Red Hat Enterprise Linux 6v5
    cpe:/o:redhat:enterprise_linux:6
  • Red Hat/Red Hat Enterprise Linux 7v5
    cpe:/o:redhat:enterprise_linux:7
  • Red Hat/Red Hat Enterprise Linux 8v5
    cpe:/o:redhat:enterprise_linux:8
  • Red Hat/Red Hat Enterprise Linux 9v5
    cpe:/o:redhat:enterprise_linux:9
  • Libsoup/Libsoupllm-fuzzy

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

3

News mentions

0

No linked articles in our index yet.