CVE-2024-52530

libsoup: HTTP request smuggling via stripping null bytes from the ends of header names

Loading…

Severity

Important

Red Hat Product Security

7.5

CVSS 3.1

Review impact separately from score.

Published · November 11, 2024

Updated · November 21, 2025

Description

A flaw was found in the Libsoup library. When Libsoup parses HTTP headers, it ignores null bytes at the end of header names. Thus, Transfer-Encoding: chunked is equivalent to Transfer-Encoding\x00: chunked. This issue allows request smuggling when Libsoup is used in a service behind a reverse proxy that forwards null bytes without stripping them.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')