CVE-2024-52530

What it actually does

Allows HTTP request smuggling because null characters appended to header names are ignored during parsing, causing headers such as Transfer-Encoding\0 to be treated as valid Transfer-Encoding directives.

Why it matters to the business

Web applications and services relying on vulnerable versions of the library may experience bypassed security controls, cache poisoning, or unauthorized request manipulation that can expose data or disrupt operations.

How an attack unfolds

An attacker sends a crafted HTTP/1.1 request containing a header name terminated by a null byte (for example Transfer-Encoding\0: chunked) to a service using the affected library; the library accepts the header and processes the request as chunked, allowing subsequent smuggled requests to be interpreted separately by backend systems.

How to fix it

Upgrade to libsoup 3.6.0 or later; apply the patch from commit 3f03218b39306870af8b7331bd2e4c18ad4ce4d0 in source builds.

How to confirm the fix worked

Confirm the running version reports 3.6.0 or newer; test header parsing with a null-terminated Transfer-Encoding header to verify the smuggling vector is closed.

Typical attack path

1. Locate a target application or service that uses a vulnerable version of the library for HTTP handling
2. Craft a request containing a header name ending in a null byte to trigger smuggling behavior
3. Transmit the request to induce inconsistent parsing between frontend and backend components
4. Leverage the smuggled requests to perform cache poisoning, access-control bypass, or other follow-on attacks

How to detect it

Search web server and application logs for HTTP headers containing embedded null bytes or unexpected chunked transfer encodings; correlate with anomalous request sequences that suggest smuggling.

What your security team should do

• Upgrade all instances of the library to the fixed release as soon as possible
• Audit configurations of HTTP clients, proxies, and servers that depend on the library
• Add defensive HTTP request validation at network boundaries until upgrades are complete
• Review downstream dependents for exposure and schedule coordinated updates