CVE-2026-6324 Libsoup: libsoup: http request smuggling via unsigned to signed conversion error
Remote attackers can exploit an integer conversion error in libsoup to bypass security controls and poison caches when used with non-libsoup proxies.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6324?
CVE-2026-6324 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, published on 29 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the `soup_body_input_stream_read_chunked()` function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.
Weakness: CWE-444
Which versions are affected by CVE-2026-6324?
How do I fix CVE-2026-6324?
Apply the vendor's patch.
Is CVE-2026-6324 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-6324 exists.
Sources
Also known as AZL-89304, DEBIAN-CVE-2026-6324, ECHO-9599-97ea-884f, GHSA-2637-3gxc-qg4f, OESA-2026-2615, OESA-2026-2616 and 1 more.