CVE-2026-6324

A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soup_body_input_stream_read_chunked() function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.

This vulnerability is rated Moderate due to the specialized network architecture and HTTP keep-alive connection reuse required to facilitate request smuggling. In standard Red Hat deployments, libsoup is primarily utilized as a client-side HTTP library by desktop and system utilities rather than as a public-facing server or reverse proxy. Successful exploitation requires an atypical topology where a libsoup-based service processes pipelined requests behind or in front of an external proxy server with differing chunk-parsing logic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.