CVE-2026-66338

A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests.

A flaw was found in libsoup where the chunked transfer encoding parser uses strtoul() to parse chunk sizes without strict validation, silently accepting inputs that violate RFC 9112. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests. The practical impact is limited because libsoup servers are rarely deployed in internet-facing infrastructure behind reverse proxies. This issue is distinct from CVE-2026-1801 which covers bare LF tolerance.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.