Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2026-2708: Libsoup HTTP Request Tampering through Unvalidated Content-Length Headers
CVE-2026-2708 · published 6 months ago
Summary
A bug in libsoup's HTTP header handling allows an attacker to manipulate HTTP requests, potentially causing incorrect data to be sent or received. This could lead to data corruption or unexpected behavior. Update to the latest version of libsoup to fix this issue.
What to do
- Update debian libsoup3 to version 3.8.0-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | gnome | libsoup |
All versions
cpe:2.3:a:gnome:libsoup:-:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux |
6.0 7.0 8.0 9.0 10.0 cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* |
| Debian:11 | debian | libsoup2.4 | All versions |
| Debian:12 | debian | libsoup2.4 | All versions |
| Debian:13 | debian | libsoup2.4 | All versions |
| Debian:12 | debian | libsoup3 | All versions |
| Debian:13 | debian | libsoup3 | All versions |
| Debian:14 | debian | libsoup3 |
< 3.8.0-1 Fix: upgrade to 3.8.0-1
|
| Ubuntu:Pro:16.04:LTS | canonical | libsoup2.4 | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | libsoup3 | All versions |
Original advisory text
A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each h...
A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.
References
- https://access.redhat.com/security/cve/CVE-2026-2708 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2440743 Issue Tracking Vendor Advisory
- https://ubuntu.com/security/CVE-2026-2708 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-2708 Third Party Advisory
- https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/513 Issue Tracking
- https://security-tracker.debian.org/tracker/CVE-2026-2708 Vendor Advisory
- https://gitlab.gnome.org/GNOME/libsoup/-/issues/500 Exploit Issue Tracking Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
5.3
Medium
Type
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Timeline
Published23 Apr 2026
Updated4 Nov 2026
First seen1 Apr 2026
Track software like this
Free during beta