CVE-2026-1801
Medium · 5.3CVSS
5.3
EPSS
0.4%
Published
Feb 3, 2026
CISA due date
—
The record
A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or user interaction by sending specially crafted chunked requests. This allows libsoup to parse and process multiple HTTP requests from a single network message, potentially leading to information disclosure.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | libsoup2 | 0 | 2.74.3-21.1 |
Related vulnerabilities
- CVE-2026-2708 A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. Also affects libsoup2
- CVE-2026-2369 A flaw was found in libsoup. Also affects libsoup2
- CVE-2026-2443 A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. Also affects libsoup2
- CVE-2026-1761 A flaw was found in libsoup. Also affects libsoup2
- CVE-2026-1760 A flaw was found in SoupServer. Also affects libsoup2
- CVE-2026-1539 A flaw was found in the libsoup HTTP library that can cause proxy authentication… Also affects libsoup2
- CVE-2026-1467 A flaw was found in libsoup, an HTTP client library. Also affects libsoup2
- CVE-2026-0716 A flaw was found in libsoup’s WebSocket frame processing when handling incoming messages. Also affects libsoup2