CVE-2026-2708 Libsoup: libsoup: http request smuggling via duplicate content-length headers
Attackers can exploit HTTP request smuggling in libsoup by sending duplicate Content-Length headers, potentially bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-2708?
CVE-2026-2708 is a low-severity vulnerability in Redhat Enterprise Linux, published on 23 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.
Weakness: CWE-444
Which versions are affected by CVE-2026-2708?
It affects 2 products.
Linux distribution packages (2)
libsoup openSUSE:Tumbleweed | All versions | 3.6.6-1.1 |
libsoup2 openSUSE:Tumbleweed | All versions | 2.74.3-17.1 |
Products include Gnome Libsoup, Redhat Enterprise Linux.
How do I fix CVE-2026-2708?
Apply the vendor's patch.
Is CVE-2026-2708 being exploited?
There is no known exploitation of CVE-2026-2708 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
- CVE-2026-102556 Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion
- CVE-2026-102557 Libsoup: libsoup: heap buffer overflow during websocket message reassembly
- CVE-2026-102558 Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth
- CVE-2026-102559 Libsoup: libsoup: heap buffer overflow during websocket client-frame masking
- CVE-2026-102560 Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth
Sources
Also known as AZL-84683, CLSA-2026-1778756991, CLSA-2026-1778836031, DEBIAN-CVE-2026-2708, ECHO-a676-b8a7-650c, GHSA-2m77-r9w3-w44v and 7 more.