CVE-2026-1760

The record

A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine Transfer-Encoding: chunked and Connection: keep-alive headers. A remote, unauthenticated client can exploit this by sending specially crafted requests, causing SoupServer to fail to close the connection as required by RFC 9112. This allows the attacker to smuggle additional requests over the persistent connection, leading to unintended request processing and potential denial-of-service (DoS) conditions.

Affected packages

Related vulnerabilities

• CVE-2026-1539 A flaw was found in the libsoup HTTP library that can cause proxy authentication… Also affects libsoup
• CVE-2026-1467 A flaw was found in libsoup, an HTTP client library. Also affects libsoup
• CVE-2024-52531 GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform… Also affects libsoup
• CVE-2024-52532 GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. Also affects libsoup
• CVE-2024-52530 GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because… Also affects libsoup
• CVE-2026-2708 A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. Also affects libsoup2
• CVE-2026-2369 A flaw was found in libsoup. Also affects libsoup2
• CVE-2026-2443 A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. Also affects libsoup2