CVE-2026-1760

EUVD-2026-5105
A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine Transfer-Encoding: chunked and Connection: keep-alive headers. A remote, unauthenticated client can exploit this by sending specially crafted requests, causing SoupServer to fail to close the connection as required by RFC 9112. This allows the attacker to smuggle additional requests over the persistent connection, leading to unintended request processing and potential denial-of-service (DoS) conditions.
HTTP Request/Response Smuggling
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 4%
Debian logo
Debian Releases
Debian Product
Codename
libsoup2.4
bookworm
no-dsa
bullseye
vulnerable
bullseye (security)
vulnerable
trixie
no-dsa
libsoup3
bookworm
no-dsa
forky
3.6.6-1
fixed
sid
3.6.6-1
fixed
trixie
no-dsa
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libsoup-2_4-1
suse enterprise desktop 15 SP7
2.74.3-150600.4.30.1
fixed
suse enterprise sap 15 SP4
2.74.2-150400.3.31.1
fixed
suse enterprise sap 15 SP5
2.74.2-150400.3.31.1
fixed
suse enterprise sap 15 SP7
2.74.3-150600.4.30.1
fixed
suse enterprise server 12 SP3
2.62.2-5.37.1
fixed
suse enterprise server 12 SP5
2.62.2-5.37.1
fixed
suse enterprise server 15 SP4
2.74.2-150400.3.31.1
fixed
suse enterprise server 15 SP5
2.74.2-150400.3.31.1
fixed
suse enterprise server 15 SP6
2.74.3-150600.4.30.1
fixed
suse enterprise server 15 SP7
2.74.3-150600.4.30.1
fixed
libsoup-2_4-1-32bit
suse enterprise server 12 SP3
2.62.2-5.37.1
fixed
suse enterprise server 12 SP5
2.62.2-5.37.1
fixed
libsoup-3_0-0
suse enterprise desktop 15 SP7
3.4.4-150600.3.37.1
fixed
suse enterprise sap 15 SP4
3.0.4-150400.3.37.1
fixed
suse enterprise sap 15 SP5
3.0.4-150400.3.37.1
fixed
suse enterprise sap 15 SP7
3.4.4-150600.3.37.1
fixed
suse enterprise server 15 SP4
3.0.4-150400.3.37.1
fixed
suse enterprise server 15 SP5
3.0.4-150400.3.37.1
fixed
suse enterprise server 15 SP6
3.4.4-150600.3.37.1
fixed
suse enterprise server 15 SP7
3.4.4-150600.3.37.1
fixed
libsoup-devel
suse enterprise desktop 15 SP7
3.4.4-150600.3.37.1
fixed
suse enterprise sap 15 SP4
3.0.4-150400.3.37.1
fixed
suse enterprise sap 15 SP5
3.0.4-150400.3.37.1
fixed
suse enterprise sap 15 SP7
3.4.4-150600.3.37.1
fixed
suse enterprise server 12 SP3
2.62.2-5.37.1
fixed
suse enterprise server 12 SP5
2.62.2-5.37.1
fixed
suse enterprise server 15 SP4
3.0.4-150400.3.37.1
fixed
suse enterprise server 15 SP5
3.0.4-150400.3.37.1
fixed
suse enterprise server 15 SP6
3.4.4-150600.3.37.1
fixed
suse enterprise server 15 SP7
3.4.4-150600.3.37.1
fixed
libsoup-lang
suse enterprise desktop 15 SP7
3.4.4-150600.3.37.1
fixed
suse enterprise sap 15 SP4
3.0.4-150400.3.37.1
fixed
suse enterprise sap 15 SP5
3.0.4-150400.3.37.1
fixed
suse enterprise sap 15 SP7
3.4.4-150600.3.37.1
fixed
suse enterprise server 12 SP3
2.62.2-5.37.1
fixed
suse enterprise server 12 SP5
2.62.2-5.37.1
fixed
suse enterprise server 15 SP4
3.0.4-150400.3.37.1
fixed
suse enterprise server 15 SP5
3.0.4-150400.3.37.1
fixed
suse enterprise server 15 SP6
3.4.4-150600.3.37.1
fixed
suse enterprise server 15 SP7
3.4.4-150600.3.37.1
fixed
libsoup2-devel
suse enterprise desktop 15 SP7
2.74.3-150600.4.30.1
fixed
suse enterprise sap 15 SP4
2.74.2-150400.3.31.1
fixed
suse enterprise sap 15 SP5
2.74.2-150400.3.31.1
fixed
suse enterprise sap 15 SP7
2.74.3-150600.4.30.1
fixed
suse enterprise server 15 SP4
2.74.2-150400.3.31.1
fixed
suse enterprise server 15 SP5
2.74.2-150400.3.31.1
fixed
suse enterprise server 15 SP6
2.74.3-150600.4.30.1
fixed
suse enterprise server 15 SP7
2.74.3-150600.4.30.1
fixed
libsoup2-lang
suse enterprise desktop 15 SP7
2.74.3-150600.4.30.1
fixed
suse enterprise sap 15 SP4
2.74.2-150400.3.31.1
fixed
suse enterprise sap 15 SP5
2.74.2-150400.3.31.1
fixed
suse enterprise sap 15 SP7
2.74.3-150600.4.30.1
fixed
suse enterprise server 15 SP4
2.74.2-150400.3.31.1
fixed
suse enterprise server 15 SP5
2.74.2-150400.3.31.1
fixed
suse enterprise server 15 SP6
2.74.3-150600.4.30.1
fixed
suse enterprise server 15 SP7
2.74.3-150600.4.30.1
fixed
typelib-1_0-Soup-2_4
suse enterprise desktop 15 SP7
2.74.3-150600.4.30.1
fixed
suse enterprise sap 15 SP4
2.74.2-150400.3.31.1
fixed
suse enterprise sap 15 SP5
2.74.2-150400.3.31.1
fixed
suse enterprise sap 15 SP7
2.74.3-150600.4.30.1
fixed
suse enterprise server 12 SP3
2.62.2-5.37.1
fixed
suse enterprise server 12 SP5
2.62.2-5.37.1
fixed
suse enterprise server 15 SP4
2.74.2-150400.3.31.1
fixed
suse enterprise server 15 SP5
2.74.2-150400.3.31.1
fixed
suse enterprise server 15 SP6
2.74.3-150600.4.30.1
fixed
suse enterprise server 15 SP7
2.74.3-150600.4.30.1
fixed
typelib-1_0-Soup-3_0
suse enterprise desktop 15 SP7
3.4.4-150600.3.37.1
fixed
suse enterprise sap 15 SP4
3.0.4-150400.3.37.1
fixed
suse enterprise sap 15 SP5
3.0.4-150400.3.37.1
fixed
suse enterprise sap 15 SP7
3.4.4-150600.3.37.1
fixed
suse enterprise server 15 SP4
3.0.4-150400.3.37.1
fixed
suse enterprise server 15 SP5
3.0.4-150400.3.37.1
fixed
suse enterprise server 15 SP6
3.4.4-150600.3.37.1
fixed
suse enterprise server 15 SP7
3.4.4-150600.3.37.1
fixed