CVE-2026-66338

Received Received - Intake

HTTP Request Smuggling in libsoup via RFC 9112 Parsing Flaw

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: Red Hat, Inc.

Description

A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-24

Last Modified

2026-07-24

Generated

2026-07-25

AI Q&A

2026-07-25

EPSS Evaluated

N/A

NVD

CVE-2026-66338

EUVD

EUVD-2026-48752

Affected Vendors & Products

Vendor	Product	Version / Range
gnome	libsoup	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

Executive Summary

This vulnerability is in libsoup, a library for HTTP client/server functionality. The issue involves the chunked transfer encoding parser accepting malformed chunk sizes that violate RFC 9112 standards. This includes inputs with leading whitespace, plus signs, or trailing invalid characters. When libsoup is behind a strict frontend proxy, attackers can exploit this to smuggle HTTP requests.

Impact Analysis

If you use software relying on libsoup, attackers might exploit this to bypass security controls, send unauthorized requests, or access sensitive data. The impact depends on the application's use of libsoup and its exposure to untrusted networks.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling HTTP request smuggling through improper chunked transfer encoding parsing. This may lead to unauthorized data access or manipulation, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Update libsoup to the latest patched version to address the chunked transfer encoding parsing flaw. Ensure frontend proxies are configured to reject malformed HTTP requests with strict parsing rules.

Hi! I’m here to help you understand CVE-2026-66338. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70