Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-6324: libsoup can be tricked to smuggle HTTP requests

CVE-2026-6324 · published 5 months ago

Summary

The libsoup libraries used in Debian and Ubuntu (packages libsoup2.4 and libsoup3) can be fooled by a specially crafted web request. This can let an attacker bypass security checks, poison web caches, or gain unauthorized access when libsoup sits behind or in front of another proxy. Update the affected libsoup packages to the latest versions provided by your distribution to close the problem.

What to do

Update debian libsoup3 to version 3.8.0-1.
Update canonical libsoup3 to version 3.0.7-0ubuntu1+esm9.
Update canonical libsoup3 to version 3.4.4-5ubuntu0.9.
Update canonical libsoup3 to version 3.6.6-1ubuntu0.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:14	debian	libsoup3	< 3.8.0-1 Fix: upgrade to 3.8.0-1
Debian:11	debian	libsoup2.4	All versions
Debian:12	debian	libsoup2.4	All versions
Debian:13	debian	libsoup2.4	All versions
Debian:12	debian	libsoup3	All versions
Debian:13	debian	libsoup3	All versions
Ubuntu:Pro:16.04:LTS	canonical	libsoup2.4	All versions
Ubuntu:Pro:22.04:LTS	canonical	libsoup3	< 3.0.7-0ubuntu1+esm9 Fix: upgrade to 3.0.7-0ubuntu1+esm9
Ubuntu:24.04:LTS	canonical	libsoup3	< 3.4.4-5ubuntu0.9 Fix: upgrade to 3.4.4-5ubuntu0.9
Ubuntu:26.04:LTS	canonical	libsoup3	< 3.6.6-1ubuntu0.1 Fix: upgrade to 3.6.6-1ubuntu0.1

Original advisory text

Libsoup: libsoup: http request smuggling via unsigned to signed conversion error

A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the `soup_body_input_stream_read_chunked()` function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.

References

https://ubuntu.com/security/CVE-2026-6324 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-6324 Third Party Advisory
https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/517 Third Party Advisory
https://ubuntu.com/security/notices/USN-8890-1 Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2026-6324 Vendor Advisory
https://access.redhat.com/downloads/content/package-browser/ URL
https://access.redhat.com/security/cve/CVE-2026-6324 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6324.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-6324 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2458479 Third Party Advisory
https://gitlab.gnome.org/GNOME/libsoup/-/issues/508 Third Party Advisory
https://gitlab.gnome.org/GNOME/libsoup/-/commit/96ac392b444d01bd5de1d1276b187c3e... Patch
https://gitlab.gnome.org/GNOME/libsoup/-/work_items/508 Exploit

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.8 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Timeline

Published29 May 2026

Updated4 Nov 2026

First seen29 May 2026

Sources

CVE-2026-6324 · NVD

DEBIAN-CVE-2026-6324 · OSV

UBUNTU-CVE-2026-6324 · OSV

CVE-2026-6324 · OSV

Track software like this

Free during beta