CVE-2026-103399

A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled request, leading to unintended request handling.

A moderate-impact HTTP/1 request-smuggling flaw exists in SoupServer when an early final response is sent for an Expect: 100-continue request whose body has not been consumed. Leftover body bytes on a reused connection can be dispatched as a new request, violating HTTP/1.1 message framing (RFC 9112). Impact is limited for typical SoupServer use: the API is intended for lightweight internal, development, or testing servers rather than hardened internet-facing deployments. Cross-client request smuggling would require a reverse proxy that pools or reuses the backend connection across clients; that scenario is not the common Red Hat deployment model for SoupServer.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this do not expose SoupServer to untrusted networks; prefer terminating proxies or internal-only listeners. If SoupServer must sit behind a reverse proxy, disable backend connection reuse/pooling across clients so an undrained body cannot prepend to another client's request.