PT-2026-6059 · Libsoup · Libsoup

Ahmed Lekssays · Published 2025-11-12 · Updated 2026-03-10 · CVE-2026-1801

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions libsoup (affected versions not specified)

Description An HTTP Request Smuggling issue exists in libsoup, an HTTP client/server library. The problem stems from non-RFC-compliant parsing within the soup filter input stream read line() function, specifically related to handling chunk headers. The library accepts improperly formatted chunk headers, such as those containing only a line feed (LF) character instead of the required carriage return and line feed (CRLF) sequence. An attacker can exploit this remotely without needing authentication or user interaction by sending crafted chunked requests. This allows the parsing and processing of multiple HTTP requests from a single network message, potentially resulting in information disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

AZL-76700

AZL-76736

BDU:2026-04954

CVE-2026-1801

OESA-2026-1449

Affected Products

Libsoup

References · 20

• https://bugzilla.redhat.com/show_bug.cgi?id=2436315 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-76700 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2026-1801 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1449 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2369 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-1801 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-76736 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1801 · Security Note
• https://ubuntu.com/security/CVE-2026-1801 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1760 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-1801 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-1801 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04954 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-1801 · Security Note
• https://access.redhat.com/security/cve/cve-2026-1801 · Note