CVE-2026-1801

A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or user interaction by sending specially crafted chunked requests. This allows libsoup to parse and process multiple HTTP requests from a single network message, potentially leading to information disclosure.

Published Feb 4, 2026

https://access.redhat.com/security/cve/cve-2026-1801

CVSS ScoreMedium

5.3

Ecosystem	Package	Version

Ecosystem	Package	Version

Vulnerabilities

CVE-2026-1801

A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or user interaction by sending specially crafted chunked requests. This allows libsoup to parse and process multiple HTTP requests from a single network message, potentially leading to information disclosure.

Published Feb 4, 2026

https://access.redhat.com/security/cve/cve-2026-1801

CVSS ScoreMedium

5.3


rpm	libsoup	2.28.2-1.el6
rpm	libsoup	2.28.2-1.el6_1.1
rpm	libsoup	2.28.2-4.el6
rpm	libsoup	2.34.3-2.el6
rpm	libsoup	2.34.3-3.el6_6
rpm	libsoup	2.34.3-5.el6
rpm	libsoup	2.42.2-3.el7
rpm	libsoup	2.46.0-3.el7
rpm	libsoup	2.48.1-3.el7
rpm	libsoup	2.48.1-6.el7
rpm	libsoup	2.56.0-3.el7
rpm	libsoup	2.56.0-4.el7_4
rpm	libsoup	2.56.0-6.el7
rpm	libsoup	2.62.2-2.0.1.el7
rpm	libsoup	2.62.2-2.el7
rpm	libsoup	2.62.3-1.el8
rpm	libsoup	2.62.3-10.el8_10
rpm	libsoup	2.62.3-11.el8_10
rpm	libsoup	2.62.3-13.el8_10
rpm	libsoup	2.62.3-2.el8
rpm	libsoup	2.62.3-3.el8
rpm	libsoup	2.62.3-4.el8
rpm	libsoup	2.62.3-5.el8
rpm	libsoup	2.62.3-6.el8_10
rpm	libsoup	2.62.3-7.el8_10
rpm	libsoup	2.62.3-8.el8_10
rpm	libsoup	2.62.3-9.el8_10
rpm	libsoup	2.72.0-10.el9_6.2
rpm	libsoup	2.72.0-10.el9_6.3
rpm	libsoup	2.72.0-12.el9_7.3
rpm	libsoup	2.72.0-12.el9_7.5
rpm	libsoup	2.72.0-8.el9
rpm	libsoup	2.72.0-8.el9_5.3
conda	main/libsoup-cos6-i686	2.34.3
conda	main/libsoup-cos6-x86_64	2.34.3
conda	main/libsoup-devel-cos6-i686	2.34.3
conda	main/libsoup-devel-cos6-x86_64	2.34.3
conda	main/libsoup-devel-cos7-s390x	2.62.2

Ecosystem	Package	Version


rpm	libsoup	2.28.2-1.el6
rpm	libsoup	2.28.2-1.el6_1.1
rpm	libsoup	2.28.2-4.el6
rpm	libsoup	2.34.3-2.el6
rpm	libsoup	2.34.3-3.el6_6
rpm	libsoup	2.34.3-5.el6
rpm	libsoup	2.42.2-3.el7
rpm	libsoup	2.46.0-3.el7
rpm	libsoup	2.48.1-3.el7
rpm	libsoup	2.48.1-6.el7
rpm	libsoup	2.56.0-3.el7
rpm	libsoup	2.56.0-4.el7_4
rpm	libsoup	2.56.0-6.el7
rpm	libsoup	2.62.2-2.0.1.el7
rpm	libsoup	2.62.2-2.el7
rpm	libsoup	2.62.3-1.el8
rpm	libsoup	2.62.3-10.el8_10
rpm	libsoup	2.62.3-11.el8_10
rpm	libsoup	2.62.3-13.el8_10
rpm	libsoup	2.62.3-2.el8
rpm	libsoup	2.62.3-3.el8
rpm	libsoup	2.62.3-4.el8
rpm	libsoup	2.62.3-5.el8
rpm	libsoup	2.62.3-6.el8_10
rpm	libsoup	2.62.3-7.el8_10
rpm	libsoup	2.62.3-8.el8_10
rpm	libsoup	2.62.3-9.el8_10
rpm	libsoup	2.72.0-10.el9_6.2
rpm	libsoup	2.72.0-10.el9_6.3
rpm	libsoup	2.72.0-12.el9_7.3
rpm	libsoup	2.72.0-12.el9_7.5
rpm	libsoup	2.72.0-8.el9
rpm	libsoup	2.72.0-8.el9_5.3
conda	main/libsoup-cos6-i686	2.34.3
conda	main/libsoup-cos6-x86_64	2.34.3
conda	main/libsoup-devel-cos6-i686	2.34.3
conda	main/libsoup-devel-cos6-x86_64	2.34.3
conda	main/libsoup-devel-cos7-s390x	2.62.2

Find vulnerabilities. Fix fast with AI.

CVE-2026-1801

CVE-2026-1801