Vulnerability · Published Jul 24, 2026 · Assigned by redhat
CVE-2026-66338Libsoup: libsoup: http request smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked()
Medium 5.4
In plain English
A medium-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Official description
A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libsoup2.4 | no fix listed | DEBIAN-CVE-2026-66338 |
| Debian:13 | libsoup2.4 | no fix listed | DEBIAN-CVE-2026-66338 |
| Debian:12 | libsoup3 | no fix listed | DEBIAN-CVE-2026-66338 |
| Debian:13 | libsoup3 | no fix listed | DEBIAN-CVE-2026-66338 |
| Ubuntu:22.04:LTS | libsoup2.4 | no fix listed | UBUNTU-CVE-2026-66338 |
| Ubuntu:24.04:LTS | libsoup2.4 | no fix listed | UBUNTU-CVE-2026-66338 |
| Ubuntu:26.10 | libsoup2.4 | no fix listed | UBUNTU-CVE-2026-66338 |
| Ubuntu:24.04:LTS | libsoup3 | no fix listed | UBUNTU-CVE-2026-66338 |
| Ubuntu:26.04:LTS | libsoup3 | no fix listed | UBUNTU-CVE-2026-66338 |
| Ubuntu:26.10 | libsoup3 | no fix listed | UBUNTU-CVE-2026-66338 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
References
- https://access.redhat.com/security/cve/CVE-2026-66338 vdb-entry, x_refsource_REDHAT
- RHBZ#2506950 issue-tracking, x_refsource_REDHAT