Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
libsoup can be tricked into HTTP request smuggling
published 2 months ago
Summary
The libsoup library may accept malformed chunk-size lines in HTTP messages, which can let an attacker hide extra requests inside a single connection. This could bypass firewalls or other security checks. Upgrade to the latest libsoup package to stop the problem.
What to do
- Update oracle libsoup to version 2.62.2-2.0.11.el7.tuxcare.els3.
- Update oracle libsoup-devel to version 2.62.2-2.0.11.el7.tuxcare.els3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:OracleLinux:7 | oracle | libsoup |
< 2.62.2-2.0.11.el7.tuxcare.els3 Fix: upgrade to 2.62.2-2.0.11.el7.tuxcare.els3
|
| TuxCare:OracleLinux:7 | oracle | libsoup-devel |
< 2.62.2-2.0.11.el7.tuxcare.els3 Fix: upgrade to 2.62.2-2.0.11.el7.tuxcare.els3
|
Original advisory text
libsoup: Fix of CVE-2026-66338
- CVE-2026-66338: reject chunk-size lines that violate RFC 9112 (leading
whitespace, sign prefix, "0x" prefix or trailing garbage) in
soup_body_input_stream_read_chunked() to prevent HTTP request smuggling
whitespace, sign prefix, "0x" prefix or trailing garbage) in
soup_body_input_stream_read_chunked() to prevent HTTP request smuggling
References
- https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1787732250.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-66338 Vendor Advisory
Timeline
Published26 Aug 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1787732250 · OSV
Track software like this
Free during beta