CVE-2026-1801 Libsoup: libsoup: http request smuggling via malformed chunk headers
Remote attackers can exploit HTTP request smuggling in libsoup via malformed chunk headers to potentially disclose sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-1801?
CVE-2026-1801 is a medium-severity vulnerability in Redhat Enterprise Linux, published on 3 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or user interaction by sending specially crafted chunked requests. This allows libsoup to parse and process multiple HTTP requests from a single network message, potentially leading to information disclosure.
Weakness: CWE-444
Which versions are affected by CVE-2026-1801?
It affects 2 products.
Linux distribution packages (8)
libsoup2 SUSE:Linux Enterprise Micro 5.3 | All versions | 2.74.2-150400.3.37.1 |
libsoup2 SUSE:Linux Enterprise Micro 5.4 | All versions | 2.74.2-150400.3.37.1 |
libsoup2 SUSE:Linux Enterprise Micro 5.5 | All versions | 2.74.2-150400.3.37.1 |
libsoup2 SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 2.74.3-150600.4.36.1 |
libsoup SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 2.62.2-5.43.1 |
libsoup SUSE:Linux Micro 6.0 | All versions | 3.4.2-16.1 |
libsoup SUSE:Linux Micro 6.1 | All versions | 3.4.4-slfo.1.1_10.1 |
libsoup2 openSUSE:Tumbleweed | All versions | 2.74.3-21.1 |
Products include Gnome Libsoup, Redhat Enterprise Linux.
How do I fix CVE-2026-1801?
Apply the vendor's patch.
Is CVE-2026-1801 being exploited?
There is no known exploitation of CVE-2026-1801 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Redhat Enterprise Linux
- CVE-2026-102556 Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion
- CVE-2026-102557 Libsoup: libsoup: heap buffer overflow during websocket message reassembly
- CVE-2026-102558 Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth
- CVE-2026-102559 Libsoup: libsoup: heap buffer overflow during websocket client-frame masking
- CVE-2026-102560 Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth
Sources
Also known as AZL-76700, AZL-76736, DEBIAN-CVE-2026-1801, ECHO-47e4-5b68-7dd8, GHSA-xv49-34rf-rqv4, SUSE-SU-2026:22061-1 and 7 more.