Vulnerability · Published Apr 23, 2026 · Assigned by redhat
CVE-2026-2708Libsoup: libsoup: http request smuggling via duplicate content-length headers
Low 3.7
In plain English
A low-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Official description
A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libsoup2.4 | no fix listed | DEBIAN-CVE-2026-2708 |
| Debian:13 | libsoup2.4 | no fix listed | DEBIAN-CVE-2026-2708 |
| Debian:12 | libsoup3 | no fix listed | DEBIAN-CVE-2026-2708 |
| Debian:13 | libsoup3 | no fix listed | DEBIAN-CVE-2026-2708 |
| Ubuntu:22.04:LTS | libsoup2.4 | no fix listed | UBUNTU-CVE-2026-2708 |
| Ubuntu:24.04:LTS | libsoup2.4 | no fix listed | UBUNTU-CVE-2026-2708 |
| Ubuntu:25.10 | libsoup2.4 | no fix listed | UBUNTU-CVE-2026-2708 |
| Ubuntu:26.10 | libsoup2.4 | no fix listed | UBUNTU-CVE-2026-2708 |
| Ubuntu:24.04:LTS | libsoup3 | no fix listed | UBUNTU-CVE-2026-2708 |
| Ubuntu:25.10 | libsoup3 | no fix listed | UBUNTU-CVE-2026-2708 |
| Ubuntu:26.04:LTS | libsoup3 | no fix listed | UBUNTU-CVE-2026-2708 |
| Ubuntu:26.10 | libsoup3 | no fix listed | UBUNTU-CVE-2026-2708 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://access.redhat.com/security/cve/CVE-2026-2708 vdb-entry, x_refsource_REDHAT
- RHBZ#2440743 issue-tracking, x_refsource_REDHAT
- https://gitlab.gnome.org/GNOME/libsoup/-/issues/500
- https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/513