VulnerabilityAnalyzed

CVE-2026-2708

A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic.

MEDIUM 5.3EPSS 0.32%

Does this matter?

Lower severity and a low EPSS score (0.32%). Track it; it rarely justifies an emergency change on its own.

Description

A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS: 0.32% probability · 25th percentile
CISA KEV: Not listed
Weakness: CWE-444
Affected: gnome/libsoup · redhat/enterprise linux
Source: secalert@redhat.com

References

https://access.redhat.com/security/cve/CVE-2026-2708Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2440743Issue Tracking, Vendor Advisory
https://gitlab.gnome.org/GNOME/libsoup/-/issues/500Exploit, Issue Tracking, Vendor Advisory
https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/513Issue Tracking

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.