{"id":"CVE-2026-2708","aliases":["AZL-84683","CLSA-2026-1778756991","CLSA-2026-1778836031","DEBIAN-CVE-2026-2708","EUVD-2026-25306","GHSA-2m77-r9w3-w44v","OESA-2026-2666","OESA-2026-2667","OESA-2026-2718","OESA-2026-2719","OESA-2026-3451","OESA-2026-3516","OESA-2026-3517","SUSE-SU-2026:0657-1","SUSE-SU-2026:0658-1","SUSE-SU-2026:0689-1","SUSE-SU-2026:0690-1","SUSE-SU-2026:0703-1","SUSE-SU-2026:0834-1","SUSE-SU-2026:20529-1","SUSE-SU-2026:20649-1","SUSE-SU-2026:20752-1","SUSE-SU-2026:20902-1","SUSE-SU-2026:24368-1","SUSE-SU-2026:4616-1","SUSE-SU-2026:4631-1","SUSE-SU-2026:4703-1","SUSE-SU-2026:4739-1","UBUNTU-CVE-2026-2708","openSUSE-SU-2026:10245-1","openSUSE-SU-2026:10246-1","openSUSE-SU-2026:20354-1","openSUSE-SU-2026:20384-1"],"status":"published","title":"Libsoup: libsoup: http request smuggling via duplicate content-length headers","description":"A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00321,"percentile":0.25374,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2026-02-24T00:00:00Z","modified":"2026-11-10T02:50:23Z","fixes":[{"ecosystem":"Azure Linux:3","package":"libsoup","fixed_in":["3.4.4-16"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libsoup","fixed_in":["2.72.0-10.el9_2.3.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libsoup-devel","fixed_in":["2.72.0-10.el9_2.3.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libsoup-doc","fixed_in":["2.72.0-10.el9_2.3.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libsoup","fixed_in":["2.72.0-10.el9_6.3.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libsoup-devel","fixed_in":["2.72.0-10.el9_6.3.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libsoup-doc","fixed_in":["2.72.0-10.el9_6.3.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"libsoup","fixed_in":["2.74.3-21.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"libsoup","fixed_in":["2.74.3-21.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"libsoup","fixed_in":["2.74.2-21.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"libsoup","fixed_in":["2.71.0-20.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libsoup","fixed_in":["3.6.6-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libsoup2","fixed_in":["2.74.3-17.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-16"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.0-10.el9_2.3.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libsoup-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.0-10.el9_2.3.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libsoup-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.0-10.el9_2.3.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.0-10.el9_6.3.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libsoup-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.0-10.el9_6.3.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libsoup-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.0-10.el9_6.3.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.74.3-1","2.74.3-1+deb12u1","2.74.3-10","2.74.3-10.1","2.74.3-11","2.74.3-2","2.74.3-3","2.74.3-3.1~exp1","2.74.3-3.1~exp2","2.74.3-3.1~exp3","2.74.3-5","2.74.3-6","2.74.3-7","2.74.3-8","2.74.3-8.1","2.74.3-9"]},{"source":"osv","ecosystem":"Debian:13","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.74.3-10.1","2.74.3-11"]},{"source":"osv","ecosystem":"Debian:12","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.2-2","3.2.3-0+deb12u1","3.2.3-0+deb12u2","3.3.1-1","3.4.0-1","3.4.1-1","3.4.2-1","3.4.2-2","3.4.2-3","3.4.2-4","3.4.3-1","3.4.4-1","3.4.4-2","3.4.4-3","3.4.4-4","3.4.4-5","3.5.2-1","3.6.0-1","3.6.0-2","3.6.0-3","3.6.0-4","3.6.1-1","3.6.4-1","3.6.4-2","3.6.4-3","3.6.5-1","3.6.5-2","3.6.5-3","3.6.5-4","3.6.5-5","3.6.5-6","3.6.5-7","3.6.5-8","3.6.5-9","3.6.6-1","3.8.0-1","3.8.0-2","3.8.0-3"]},{"source":"osv","ecosystem":"Debian:13","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.5-3","3.6.5-4","3.6.5-5","3.6.5-6","3.6.5-7","3.6.5-8","3.6.5-9","3.6.6-1","3.8.0-1","3.8.0-2","3.8.0-3"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-19.oe2403sp1"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-19.oe2403sp3"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-21.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-21.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-24.oe2403sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-21.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.71.0-20.oe2003sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150600.4.27.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150600.4.27.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150600.4.27.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150600.4.27.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.68.4-150200.4.30.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.34.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.34.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.34.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.34.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.34.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.34.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.34.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.34.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-150600.3.34.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-150600.3.34.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-150600.3.34.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-150600.3.34.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.2-5.34.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.2-5.34.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-150400.3.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-150400.3.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-150400.3.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-150400.3.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-150400.3.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-150400.3.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-150400.3.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-150400.3.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-150400.3.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-150400.3.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-150400.3.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-slfo.1.1_7.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-159998.1.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-150600.3.59.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-150600.3.59.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-150600.3.59.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150600.4.42.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150600.4.42.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150600.4.42.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150400.3.43.1"}]}],"bundled":15},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.50.0-2debian1","2.52.1-1","2.52.2-1","2.52.2-1ubuntu0.1","2.52.2-1ubuntu0.2","2.52.2-1ubuntu0.3","2.52.2-1ubuntu0.3+esm1","2.52.2-1ubuntu0.3+esm2","2.52.2-1ubuntu0.3+esm3","2.52.2-1ubuntu0.3+esm4","2.52.2-1ubuntu0.3+esm5","2.52.2-1ubuntu0.3+esm6","2.52.2-1ubuntu0.3+esm7","2.52.2-1ubuntu0.3+esm8","2.52.2-1ubuntu0.3+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.60.1-1","2.60.2-1","2.60.2-2","2.60.3-1","2.61.90-1","2.62.0-1","2.62.1-1","2.62.1-1ubuntu0.1","2.62.1-1ubuntu0.3","2.62.1-1ubuntu0.4","2.62.1-1ubuntu0.4+esm1","2.62.1-1ubuntu0.4+esm2","2.62.1-1ubuntu0.4+esm3","2.62.1-1ubuntu0.4+esm4","2.62.1-1ubuntu0.4+esm5","2.62.1-1ubuntu0.4+esm6","2.62.1-1ubuntu0.4+esm7","2.62.1-1ubuntu0.4+esm8","2.62.1-1ubuntu0.4+esm9","2.62.1-1ubuntu0.4+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.68.2-0ubuntu1","2.68.2-1","2.68.2-2","2.68.2-2build2","2.69.90-1","2.70.0-1","2.70.0-1ubuntu0.1","2.70.0-1ubuntu0.2","2.70.0-1ubuntu0.3","2.70.0-1ubuntu0.4","2.70.0-1ubuntu0.5","2.70.0-1ubuntu0.5+esm1","2.70.0-1ubuntu0.5+esm2","2.70.0-1ubuntu0.5+esm3","2.70.0-1ubuntu0.5+esm4","2.70.0-1ubuntu0.5+esm5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.72.0-3ubuntu3","2.74.1-1","2.74.2-2","2.74.2-3","2.74.2-3ubuntu0.1","2.74.2-3ubuntu0.2","2.74.2-3ubuntu0.3","2.74.2-3ubuntu0.4","2.74.2-3ubuntu0.5","2.74.2-3ubuntu0.6","2.74.2-3ubuntu0.7","2.74.2-3ubuntu0.8","2.74.2-3ubuntu0.9","2.74.2-3ubuntu0.10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.4-2","3.0.4-3","3.0.5-1","3.0.7-0ubuntu1","3.0.7-0ubuntu1+esm1","3.0.7-0ubuntu1+esm2","3.0.7-0ubuntu1+esm3","3.0.7-0ubuntu1+esm4","3.0.7-0ubuntu1+esm5","3.0.7-0ubuntu1+esm6","3.0.7-0ubuntu1+esm7","3.0.7-0ubuntu1+esm8","3.0.7-0ubuntu1+esm9","3.0.7-0ubuntu1+esm10"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.74.3-1","2.74.3-2","2.74.3-3","2.74.3-6","2.74.3-6build1","2.74.3-6ubuntu1","2.74.3-6ubuntu1.1","2.74.3-6ubuntu1.2","2.74.3-6ubuntu1.3","2.74.3-6ubuntu1.4","2.74.3-6ubuntu1.5","2.74.3-6ubuntu1.6","2.74.3-6ubuntu1.7","2.74.3-6ubuntu1.8","2.74.3-6ubuntu1.9","2.74.3-6ubuntu1.10"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.2-4","3.4.4-1","3.4.4-2","3.4.4-4","3.4.4-5","3.4.4-5build1","3.4.4-5build2","3.4.4-5ubuntu0.1","3.4.4-5ubuntu0.2","3.4.4-5ubuntu0.3","3.4.4-5ubuntu0.4","3.4.4-5ubuntu0.5","3.4.4-5ubuntu0.6","3.4.4-5ubuntu0.7","3.4.4-5ubuntu0.8","3.4.4-5ubuntu0.9","3.4.4-5ubuntu0.10","3.4.4-5ubuntu0.11"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.74.3-10","2.74.3-10.1","2.74.3-10.1ubuntu1","2.74.3-10.1ubuntu2","2.74.3-10.1ubuntu3","2.74.3-10.1ubuntu4","2.74.3-10.1ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.5-1","3.6.5-1ubuntu1","3.6.5-3","3.6.5-4","3.6.5-4ubuntu0.1","3.6.5-4ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.74.3-10.1ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.6-1","3.6.6-1ubuntu3","3.6.6-1ubuntu3.1","3.6.6-1ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.5-4","3.6.5-5","3.6.5-6","3.6.5-7","3.6.5-9","3.6.6-1","3.6.6-1ubuntu0.1","3.6.6-1ubuntu0.2","3.6.6-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.74.3-10.1ubuntu4","2.74.3-10.1ubuntu5","2.74.3-10.1ubuntu5+esm1","2.74.3-10.1ubuntu5+esm2","2.74.3-10.1ubuntu5+esm3","2.74.3-10.1ubuntu5+esm4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-17.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-160000.4.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-160000.1.1"}]}],"bundled":9}],"products":[{"vendor":"gnome","product":"libsoup"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-2708","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2440743","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libsoup/-/issues/500","tags":["Exploit","Issue Tracking","Vendor Advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/513","tags":["Issue Tracking"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2708","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-2m77-r9w3-w44v"},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1778756991.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1778836031.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-2708","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2666","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32049","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32050","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32051","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32907","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1760","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2436","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2667","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2718","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2719","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3451","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12478","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3516","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3517","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260657-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1240751","tags":["report"]},{"url":"https://bugzilla.suse.com/1258120","tags":["report"]},{"url":"https://bugzilla.suse.com/1258170","tags":["report"]},{"url":"https://bugzilla.suse.com/1258508","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2708","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260658-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260689-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260690-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260703-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243422","tags":["report"]},{"url":"https://bugzilla.suse.com/1256418","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0716","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260834-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257398","tags":["report"]},{"url":"https://bugzilla.suse.com/1257441","tags":["report"]},{"url":"https://bugzilla.suse.com/1257597","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1760","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620529-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1252555","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-12105","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620649-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257440","tags":["report"]},{"url":"https://bugzilla.suse.com/1257598","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1761","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620752-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1254876","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14523","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620902-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624368-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271446","tags":["report"]},{"url":"https://bugzilla.suse.com/1271447","tags":["report"]},{"url":"https://bugzilla.suse.com/1271448","tags":["report"]},{"url":"https://bugzilla.suse.com/1271449","tags":["report"]},{"url":"https://bugzilla.suse.com/1272195","tags":["report"]},{"url":"https://bugzilla.suse.com/1272196","tags":["report"]},{"url":"https://bugzilla.suse.com/1273156","tags":["report"]},{"url":"https://bugzilla.suse.com/1283299","tags":["report"]},{"url":"https://bugzilla.suse.com/1283300","tags":["report"]},{"url":"https://bugzilla.suse.com/1283301","tags":["report"]},{"url":"https://bugzilla.suse.com/1283302","tags":["report"]},{"url":"https://bugzilla.suse.com/1283303","tags":["report"]},{"url":"https://bugzilla.suse.com/1283304","tags":["report"]},{"url":"https://bugzilla.suse.com/1283831","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-103399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66339","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264616-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264631-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264703-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1275988","tags":["report"]},{"url":"https://bugzilla.suse.com/1276759","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77680","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264739-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-2708","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2708","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1256399","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0719","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-2708","title":"Libsoup: libsoup: http request smuggling via duplicate content-length headers","description":"A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.","status":"published","published":"2026-04-23T21:51:23.475Z","modified":"2026-11-06T18:23:22.965Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-444"],"updated_at":"2026-11-06T19:59:19.701997Z"}],"euvd":[{"id":"EUVD-2026-25306","description":"A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.","status":"published","published":"2026-04-23T21:51:23Z","modified":"2026-11-06T18:23:22Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-06T19:05:52.672747Z"}],"ghsa":[{"id":"GHSA-2m77-r9w3-w44v","title":"A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The...","description":"A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.","status":"published","published":"2026-04-24T00:31:51Z","modified":"2026-04-24T00:31:58Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:07:37.11234Z"}],"nvd":[{"id":"CVE-2026-2708","description":"A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.","status":"published","published":"2026-04-23T22:16:29.233Z","modified":"2026-11-06T19:17:49.23Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-444"],"updated_at":"2026-11-06T22:02:11.743368Z"}],"osv":[{"id":"DEBIAN-CVE-2026-2708","description":"A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.","status":"published","published":"2026-04-23T22:16:29.233Z","modified":"2026-11-07T09:47:36.748524147Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-07T10:14:19.880839Z"},{"id":"OESA-2026-2666","title":"libsoup3 security update","description":"Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).(CVE-2025-32049)\n\nA flaw was found in libsoup. The libsoup append_param_quoted() function may contain an overflow bug resulting in a buffer under-read.(CVE-2025-32050)\n\nA flaw was found in libsoup. The libsoup soup_uri_decode_data_uri() function may crash when processing malformed data URI. This flaw allows an attacker to cause a denial of service (DoS).(CVE-2025-32051)\n\nA flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of service.(CVE-2025-32907)\n\nA flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine Transfer-Encoding: chunked and Connection: keep-alive headers. A remote, unauthenticated client can exploit this by sending specially crafted requests, causing SoupServer to fail to close the connection as required by RFC 9112. This allows the attacker to smuggle additional requests over the persistent connection, leading to unintended request processing and potential denial-of-service (DoS) conditions.(CVE-2026-1760)\n\nA flaw was found in libsoup\u0026apos;s SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service.(CVE-2026-2436)\n\nA request smuggling vulnerability exists in libsoup\u0026apos;s HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.(CVE-2026-2708)","status":"published","published":"2026-06-12T11:11:36Z","modified":"2026-08-18T01:20:04.989710599Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2667","title":"libsoup3 security update","description":"Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).(CVE-2025-32049)\n\nA flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of service.(CVE-2025-32907)\n\nA flaw was found in libsoup\u0026apos;s SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service.(CVE-2026-2436)\n\nA request smuggling vulnerability exists in libsoup\u0026apos;s HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.(CVE-2026-2708)","status":"published","published":"2026-06-12T11:11:36Z","modified":"2026-08-18T01:20:05.092294181Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2718","title":"libsoup security update","description":"libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.\r\n\r\nSecurity Fix(es):\n\nA request smuggling vulnerability exists in libsoup\u0026apos;s HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.(CVE-2026-2708)","status":"published","published":"2026-06-24T11:11:38Z","modified":"2026-08-18T01:20:06.313149823Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2719","title":"libsoup security update","description":"libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.\r\n\r\nSecurity Fix(es):\n\nA request smuggling vulnerability exists in libsoup\u0026apos;s HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.(CVE-2026-2708)","status":"published","published":"2026-06-24T11:11:38Z","modified":"2026-08-18T01:20:06.294161208Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-3451","title":"libsoup security update","description":"libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.\r\n\r\nSecurity Fix(es):\n\nThe fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.(CVE-2026-12478)\n\nA request smuggling vulnerability exists in libsoup\u0026apos;s HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.(CVE-2026-2708)","status":"published","published":"2026-08-20T09:58:31Z","modified":"2026-08-20T10:15:11.962845254Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3516","title":"libsoup security update","description":"libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.\r\n\r\nSecurity Fix(es):\n\nA request smuggling vulnerability exists in libsoup\u0026apos;s HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.(CVE-2026-2708)","status":"published","published":"2026-08-30T04:14:39Z","modified":"2026-08-30T04:31:11.392604799Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3517","title":"libsoup security update","description":"libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.\r\n\r\nSecurity Fix(es):\n\nA request smuggling vulnerability exists in libsoup\u0026apos;s HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.(CVE-2026-2708)","status":"published","published":"2026-08-30T04:14:40Z","modified":"2026-08-30T04:31:36.727435536Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"UBUNTU-CVE-2026-2708","description":"A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.","status":"published","published":"2026-04-23T22:16:00Z","modified":"2026-11-10T02:50:23.880297745Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-10T03:19:05.90942Z"},{"id":"AZL-84683","title":"CVE-2026-2708 affecting package libsoup for versions less than 3.4.4-16","description":"A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.","status":"published","published":"2026-04-23T22:16:29Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.988217Z"},{"id":"CLSA-2026-1778756991","title":"libsoup: Fix of CVE-2026-2708","description":"- CVE-2026-2708: reject duplicate Content-Length headers with different values\n  to prevent HTTP request smuggling per RFC 9110 section 7.7","status":"published","published":"2026-05-16T15:25:01Z","modified":"2026-06-01T00:32:30.797345715Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778836031","title":"libsoup: Fix of CVE-2026-2708","description":"- CVE-2026-2708: reject duplicate Content-Length headers with different values\n  to prevent HTTP request smuggling per RFC 9110 section 7.7","status":"published","published":"2026-05-16T17:30:12Z","modified":"2026-06-01T00:32:52.391868421Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"openSUSE-SU-2026:10245-1","title":"libsoup-3_0-0-3.6.6-1.1 on GA media","description":"These are all security issues fixed in the libsoup-3_0-0-3.6.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-24T00:00:00Z","modified":"2026-03-23T04:54:37.044593Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10246-1","title":"libsoup-2_4-1-2.74.3-17.1 on GA media","description":"These are all security issues fixed in the libsoup-2_4-1-2.74.3-17.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-24T00:00:00Z","modified":"2026-03-23T04:54:37.342567Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20354-1","title":"Security update for libsoup2","description":"This update for libsoup2 fixes the following issues:\n\n- CVE-2025-4476: null pointer dereference may lead to denial of service (bsc#1243422).\n- CVE-2025-14523: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (bsc#1254876).\n- CVE-2025-32049: Denial of Service attack to websocket server (bsc#1240751).\n- CVE-2026-0716: improper bounds handling may allow out-of-bounds read (bsc#1256418).\n- CVE-2026-0719: stack-based buffer overflow in NTLM authentication can lead to arbitrary code execution (bsc#1256399).\n- CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests (bsc#1257398).\n- CVE-2026-1539: proxy authentication credentials leaked via the Proxy-Authorization header when handling HTTP redirects\n  (bsc#1257441).\n- CVE-2026-1760: improper handling of HTTP requests combining certain headers by SoupServer can lead to HTTP request\n  smuggling and potential DoS (bsc#1257597).\n- CVE-2026-2369: Buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).\n- CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information\n  disclosure to remote attackers (bsc#1258170).\n- CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).\n","status":"published","published":"2026-03-13T08:41:04Z","modified":"2026-03-23T04:54:51.216884Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20384-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\nUpdate to libsoup 3.6.6:\n\n- CVE-2025-12105: heap use-after-free in message queue handling during HTTP/2 read completion (bsc#1252555).\n- CVE-2025-14523: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (bsc#1254876).\n- CVE-2025-32049: Denial of Service attack to websocket server (bsc#1240751).\n- CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests (bsc#1257398).\n- CVE-2026-1539: proxy authentication credentials leaked via the Proxy-Authorization header when handling HTTP redirects\n  (bsc#1257441).\n- CVE-2026-1760: improper handling of HTTP requests combining certain headers by SoupServer can lead to HTTP request\n  smuggling and potential DoS (bsc#1257597).\n- CVE-2026-2369: Buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).\n- CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information\n  disclosure to remote attackers (bsc#1258170).\n- CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).\n\nChangelog:\n\n- websocket: Fix out-of-bounds read in process_frame\n- Check nulls returned by soup_date_time_new_from_http_string()\n- Numerous fixes to handling of Range headers\n- server: close the connection after responsing a request\ncontaining Content-Length and Transfer-Encoding\n- Use CRLF as line boundary when parsing chunked enconding data\n- websocket: do not accept messages frames after closing due to\nan error\n- Sanitize filename of content disposition header values\n- Always validate the headers value when coming from untrusted\nsource\n- uri-utils: do host validation when checking if a GUri is valid\n- multipart: check length of bytes read\nsoup_filter_input_stream_read_until()\n- message-headers: Reject duplicate Host headers\n- server: null-check soup_date_time_to_string()\n- auth-digest: fix crash in\nsoup_auth_digest_get_protection_space()\n- session: fix 'heap-use-after-free' caused by 'finishing' queue\nitem twice\n- cookies: Avoid expires attribute if date is invalid\n- http1: Set EOF flag once content-length bytes have been read\n- date-utils: Add value checks for date/time parsing\n- multipart: Fix multiple boundry limits\n- Fixed multiple possible memory leaks\n- message-headers: Correct merge of ranges\n- body-input-stream: Correct chunked trailers end detection\n- server-http2: Correctly validate URIs\n- multipart: Fix read out of buffer bounds under\nsoup_multipart_new_from_message()\n- headers: Ensure Request-Line comprises entire first line\n- tests: Fix MSVC build error\n- Fix possible deadlock on init from gmodule usage\n- Updated translations.\n","status":"published","published":"2026-03-18T10:01:12Z","modified":"2026-03-26T17:23:50.017272Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:0657-1","title":"Security update for libsoup2","description":"This update for libsoup2 fixes the following issues:\n\n- CVE-2025-32049: denial of Service attack to websocket server (bsc#1240751).\n- CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).\n- CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information\n  disclosure to remote attackers (bsc#1258170).\n- CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).\n","status":"published","published":"2026-02-26T15:07:11Z","modified":"2026-03-23T04:52:23.877365Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0658-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2025-32049: denial of Service attack to websocket server (bsc#1240751).\n- CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).\n- CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information\n  disclosure to remote attackers (bsc#1258170).\n- CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).\n","status":"published","published":"2026-02-26T15:07:42Z","modified":"2026-03-23T04:52:23.821194Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0689-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2025-32049: denial of Service attack to websocket server (bsc#1240751).\n- CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).\n- CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information\n  disclosure to remote attackers (bsc#1258170).\n- CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).\n","status":"published","published":"2026-02-27T15:10:48Z","modified":"2026-03-23T04:52:26.179645Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:0690-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2025-32049: denial of Service attack to websocket server (bsc#1240751).\n- CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).\n- CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information\n  disclosure to remote attackers (bsc#1258170).\n- CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).\n","status":"published","published":"2026-02-27T15:11:03Z","modified":"2026-03-23T04:52:26.47742Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:0703-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2026-0716: improper bounds handling may allow out-of-bounds read (bsc#1256418).\n- CVE-2025-4476: null pointer dereference may lead to denial of service (bsc#1243422).\n- CVE-2025-32049: denial of Service attack to websocket server (bsc#1240751).\n- CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).\n- CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information\n  disclosure to remote attackers (bsc#1258170).\n- CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).\n","status":"published","published":"2026-02-28T10:01:49Z","modified":"2026-03-23T04:51:38.258573Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:0834-1","title":"Security update for libsoup2","description":"This update for libsoup2 fixes the following issues:\n\n- CVE-2025-32049: denial of service attack to websocket server (bsc#1240751).\n- CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests (bsc#1257398).\n- CVE-2026-1539: proxy authentication credentials leaked via the Proxy-Authorization header when handling HTTP redirects\n  (bsc#1257441).\n- CVE-2026-1760: improper handling of HTTP requests combining certain headers by SoupServer can lead to HTTP request\n  smuggling and potential DoS (bsc#1257597).\n- CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).\n- CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information\n  disclosure to remote attackers (bsc#1258170).\n- CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).\n","status":"published","published":"2026-03-05T20:00:24Z","modified":"2026-03-07T16:15:07.262775Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:20529-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2025-12105: Fixed heap use-after-free in message queue handling during HTTP/2 read completion. (bsc#1252555)\n- CVE-2025-32049: Fixed a Denial of Service attack to websocket server. (bsc#1240751)\n- CVE-2026-2443: Fixed an out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers. (bsc#1258170)\n- CVE-2026-2369: Fixed a buffer overread due to integer underflow when handling zero-length resources. (bsc#1258120)\n- CVE-2026-2708: Fixed HTTP request smuggling via duplicate Content-Length headers. (bsc#1258508)\n","status":"published","published":"2026-03-02T13:19:17Z","modified":"2026-03-04T22:17:29.328557Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20649-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2025-32049: denial of service attack to websocket server (bsc#1240751).\n- CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests (bsc#1257398).\n- CVE-2026-1536: HTTP header injection or response splitting via CRLF injection in the Content-Disposition header\n  (bsc#1257440).\n- CVE-2026-1539: proxy authentication credentials leaked via the Proxy-Authorization header when handling HTTP redirects\n  (bsc#1257441).\n- CVE-2026-1760: improper handling of HTTP requests combining certain headers by SoupServer can lead to HTTP request\n  smuggling and potential DoS (bsc#1257597).\n- CVE-2026-1761: incorrect length calculation when parsing of multipart HTTP responses can lead to a stack-based buffer\n  overflow (bsc#1257598).\n- CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).\n- CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information\n  disclosure to remote attackers (bsc#1258170).\n- CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).\n","status":"published","published":"2026-03-03T15:01:12Z","modified":"2026-03-23T04:53:06.190847Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20752-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\nUpdate to libsoup 3.6.6:\n\n- CVE-2025-12105: heap use-after-free in message queue handling during HTTP/2 read completion (bsc#1252555).\n- CVE-2025-14523: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (bsc#1254876).\n- CVE-2025-32049: Denial of Service attack to websocket server (bsc#1240751).\n- CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests (bsc#1257398).\n- CVE-2026-1539: proxy authentication credentials leaked via the Proxy-Authorization header when handling HTTP redirects\n  (bsc#1257441).\n- CVE-2026-1760: improper handling of HTTP requests combining certain headers by SoupServer can lead to HTTP request\n  smuggling and potential DoS (bsc#1257597).\n- CVE-2026-2369: Buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).\n- CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information\n  disclosure to remote attackers (bsc#1258170).\n- CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).\n\nChangelog:\n\n- websocket: Fix out-of-bounds read in process_frame\n- Check nulls returned by soup_date_time_new_from_http_string()\n- Numerous fixes to handling of Range headers\n- server: close the connection after responsing a request\ncontaining Content-Length and Transfer-Encoding\n- Use CRLF as line boundary when parsing chunked enconding data\n- websocket: do not accept messages frames after closing due to\nan error\n- Sanitize filename of content disposition header values\n- Always validate the headers value when coming from untrusted\nsource\n- uri-utils: do host validation when checking if a GUri is valid\n- multipart: check length of bytes read\nsoup_filter_input_stream_read_until()\n- message-headers: Reject duplicate Host headers\n- server: null-check soup_date_time_to_string()\n- auth-digest: fix crash in\nsoup_auth_digest_get_protection_space()\n- session: fix 'heap-use-after-free' caused by 'finishing' queue\nitem twice\n- cookies: Avoid expires attribute if date is invalid\n- http1: Set EOF flag once content-length bytes have been read\n- date-utils: Add value checks for date/time parsing\n- multipart: Fix multiple boundry limits\n- Fixed multiple possible memory leaks\n- message-headers: Correct merge of ranges\n- body-input-stream: Correct chunked trailers end detection\n- server-http2: Correctly validate URIs\n- multipart: Fix read out of buffer bounds under\nsoup_multipart_new_from_message()\n- headers: Ensure Request-Line comprises entire first line\n- tests: Fix MSVC build error\n- Fix possible deadlock on init from gmodule usage\n- Updated translations.\n","status":"published","published":"2026-03-18T10:01:36Z","modified":"2026-03-25T17:23:42.753244Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20902-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\nUpdate to libsoup 3.6.6:\n\n- CVE-2025-12105: heap use-after-free in message queue handling during HTTP/2 read completion (bsc#1252555).\n- CVE-2025-14523: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (bsc#1254876).\n- CVE-2025-32049: Denial of Service attack to websocket server (bsc#1240751).\n- CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests (bsc#1257398).\n- CVE-2026-1539: proxy authentication credentials leaked via the Proxy-Authorization header when handling HTTP redirects\n  (bsc#1257441).\n- CVE-2026-1760: improper handling of HTTP requests combining certain headers by SoupServer can lead to HTTP request\n  smuggling and potential DoS (bsc#1257597).\n- CVE-2026-2369: Buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).\n- CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information\n  disclosure to remote attackers (bsc#1258170).\n- CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).\n\nChangelog:\n\n- websocket: Fix out-of-bounds read in process_frame\n- Check nulls returned by soup_date_time_new_from_http_string()\n- Numerous fixes to handling of Range headers\n- server: close the connection after responsing a request\ncontaining Content-Length and Transfer-Encoding\n- Use CRLF as line boundary when parsing chunked enconding data\n- websocket: do not accept messages frames after closing due to\nan error\n- Sanitize filename of content disposition header values\n- Always validate the headers value when coming from untrusted\nsource\n- uri-utils: do host validation when checking if a GUri is valid\n- multipart: check length of bytes read\nsoup_filter_input_stream_read_until()\n- message-headers: Reject duplicate Host headers\n- server: null-check soup_date_time_to_string()\n- auth-digest: fix crash in\nsoup_auth_digest_get_protection_space()\n- session: fix 'heap-use-after-free' caused by 'finishing' queue\nitem twice\n- cookies: Avoid expires attribute if date is invalid\n- http1: Set EOF flag once content-length bytes have been read\n- date-utils: Add value checks for date/time parsing\n- multipart: Fix multiple boundry limits\n- Fixed multiple possible memory leaks\n- message-headers: Correct merge of ranges\n- body-input-stream: Correct chunked trailers end detection\n- server-http2: Correctly validate URIs\n- multipart: Fix read out of buffer bounds under\nsoup_multipart_new_from_message()\n- headers: Ensure Request-Line comprises entire first line\n- tests: Fix MSVC build error\n- Fix possible deadlock on init from gmodule usage\n- Updated translations.\n","status":"published","published":"2026-03-18T10:01:36Z","modified":"2026-04-02T17:23:46.486669Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:24368-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2026-12547: Header \"Proxy-Authorization\" leads to credentials being send to different proxy after proxy switch\n  (bsc#1272195).\n- CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation (bsc#1272196).\n- CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol\n  violation (bsc#1271446).\n- CVE-2026-15712: SoupClientMessageIOHTTP2: HTTP/2 GOAWAY frame parsing heap buffer over-read via invalid NUL-\n  termination assumption (bsc#1271447).\n- CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak\n  (bsc#1271448).\n- CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers\n  via an oversized multipart boundary string (bsc#1271449).\n- CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT tunnels\n  (bsc#1273156).\n- CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding (bsc#1283299).\n- CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).\n- CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).\n- CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).\n- CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).\n- CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).\n- CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling\n  (bsc#1283831).\n","status":"published","published":"2026-10-21T08:56:44Z","modified":"2026-10-27T17:23:18.80097485Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4616-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak\n  (bsc#1271448).\n- CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding (bsc#1283299).\n- CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).\n- CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).\n- CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).\n- CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).\n- CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).\n","status":"published","published":"2026-10-12T07:21:28Z","modified":"2026-10-13T10:30:04.879685509Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4631-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak\n  (bsc#1271448).\n- CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding (bsc#1283299).\n- CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).\n- CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).\n- CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).\n- CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).\n- CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).\n","status":"published","published":"2026-10-12T15:25:46Z","modified":"2026-10-13T10:30:06.857496744Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4703-1","title":"Security update for libsoup2","description":"This update for libsoup2 fixes the following issues:\n\n- CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch\n  (bsc#1272195).\n- CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol\n  violation (bsc#1271446).\n- CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak\n  (bsc#1271448).\n- CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers via\n  an oversized multipart boundary string (bsc#1271449).\n- CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT tunnels\n  (bsc#1273156).\n- CVE-2026-77014: Integer truncation in sort_ranges() comparator causes silent omission of HTTP Range responses\n  (bsc#1275988).\n- CVE-2026-77680: quadratic CPU denial of service in HTTP Range coalescing after the CVE-2025-32907 fix (bsc#1276759).\n- CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).\n- CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).\n- CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).\n- CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).\n- CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).\n- CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling\n  (bsc#1283831).\n","status":"published","published":"2026-10-16T13:29:46Z","modified":"2026-10-17T10:00:04.12517112Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4739-1","title":"Security update for libsoup2","description":"This update for libsoup2 fixes the following issues:\n\n- CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch\n  (bsc#1272195).\n- CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol\n  violation (bsc#1271446).\n- CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak\n  (bsc#1271448).\n- CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers via\n  an oversized multipart boundary string (bsc#1271449).\n- CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT tunnels\n  (bsc#1273156).\n- CVE-2026-77014: Integer truncation in sort_ranges() comparator causes silent omission of HTTP Range responses\n  (bsc#1275988).\n- CVE-2026-77680: quadratic CPU denial of service in HTTP Range coalescing after the CVE-2025-32907 fix (bsc#1276759).\n- CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).\n- CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).\n- CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).\n- CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).\n- CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).\n- CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling\n  (bsc#1283831).\n","status":"published","published":"2026-10-19T12:59:37Z","modified":"2026-10-20T10:45:04.185304919Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}