Summary
It was discovered that libsoup incorrectly handled certain URLs when
using an HTTP proxy. A remote attacker could possibly use this issue to
inject arbitrary HTTP headers. (CVE-2026-1467)
It was discovered that libsoup did not remove proxy authentication
credentials when following HTTP redirects. A remote attacker could
possibly use this issue to obtain sensitive information.
(CVE-2026-1539)
Ahmed Lekssays discovered that libsoup incorrectly parsed certain HTTP
requests. A remote attacker could possibly use this issue to obtain
sensitive information. (CVE-2026-1801)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | libsoup2.4 | 2.74.2-3ubuntu0.8 |
| Ubuntu · 24.04 LTS 24.04:LTS | libsoup2.4 | 2.74.3-6ubuntu1.8 |
| Ubuntu · 24.04 LTS 24.04:LTS | libsoup3 | 3.4.4-5ubuntu0.8 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libsoup2.4 | 2.52.2-1ubuntu0.3+esm7 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libsoup2.4 | 2.62.1-1ubuntu0.4+esm8 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libsoup2.4 | 2.70.0-1ubuntu0.5+esm3 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | libsoup3 | 3.0.7-0ubuntu1+esm8 |
| Ubuntu · Pro 26.04 LTS Pro:26.04:LTS | libsoup2.4 | 2.74.3-10.1ubuntu5+esm2 |
Vulnerabilities 3
-
Medium 5.8
Libsoup: libsoup: http header injection via specially crafted urls when an http proxy is configured
A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF (Carriage Return Line Feed) Injection, occurs when an HTTP proxy is configured and the library improperly handles URL-decoded input used to create the Host header. A remote…
-
Medium 5.8
Libsoup: libsoup: credential leakage via http redirects
A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTTP redirects, libsoup removes the Authorization header but does not remove the Proxy-Authorization header if th…
-
Medium 5.3CVE-2026-1801 Public exploit
Libsoup: libsoup: http request smuggling via malformed chunk headers
A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line fee…