Skip to content
OpenAdvisories
Medium · 4.8 CVE-2026-6324 EUVD-2026-33249GHSA-2637-3gxc-qg4f

Libsoup: libsoup: http request smuggling via unsigned to signed conversion error

Published May 29, 2026 · Updated Nov 5, 2026 · Assigned by redhat

Description

A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the `soup_body_input_stream_read_chunked()` function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat Enterprise Linux 10 — —
Red Hat Red Hat Enterprise Linux 6 — —
Red Hat Red Hat Enterprise Linux 7 — —
Red Hat Red Hat Enterprise Linux 8 — —
Red Hat Red Hat Enterprise Linux 9 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 13 libsoup3 +1 No fix yet —
Debian 12 libsoup3 +1 No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 libsoup2.4 No fix yet —
Ubuntu 26.10 libsoup3 3.6.6-1ubuntu3 USN-8890-2
Ubuntu 26.04 LTS libsoup2.4 No fix yet —
Ubuntu 26.04 LTS libsoup3 3.6.6-1ubuntu0.1 USN-8890-1
Ubuntu 25.10 libsoup3 +1 No fix yet —
Ubuntu 24.04 LTS libsoup2.4 2.74.3-6ubuntu1.9 USN-8890-1
Ubuntu 24.04 LTS libsoup3 3.4.4-5ubuntu0.9 USN-8890-1
Ubuntu 22.04 LTS libsoup2.4 2.74.2-3ubuntu0.9 USN-8890-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS libsoup2.4 2.74.3-10.1ubuntu5+esm3 USN-8890-1
Ubuntu Pro 22.04 LTS libsoup3 3.0.7-0ubuntu1+esm9 USN-8890-1
Ubuntu Pro 20.04 LTS libsoup2.4 2.70.0-1ubuntu0.5+esm4 USN-8890-1
Ubuntu Pro 18.04 LTS libsoup2.4 2.62.1-1ubuntu0.4+esm9 USN-8890-1
Ubuntu Pro 16.04 LTS libsoup2.4 2.52.2-1ubuntu0.3+esm8 USN-8890-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 libsoup 3.4.4-16 —

Advisories 2

References