CVE-2024-52530: GNOME Libsoup HTTP Smuggling Vulnerability

CVE-2024-52530 Overview

CVE-2024-52530 is an HTTP request smuggling vulnerability in GNOME libsoup versions before 3.6.0. The library ignores null (\0) characters at the end of HTTP header names, causing a Transfer-Encoding\0: chunked header to be treated identically to a standard Transfer-Encoding: chunked header. Attackers can exploit this inconsistency when libsoup sits behind or in front of a different HTTP implementation to desynchronize request parsing. The flaw maps to CWE-444 (Inconsistent Interpretation of HTTP Requests).

Critical Impact

Attackers can smuggle malicious HTTP requests past front-end proxies, leading to cache poisoning, request hijacking, security control bypass, and credential theft against applications using libsoup.

Affected Products

• GNOME libsoup versions prior to 3.6.0
• Linux distributions packaging vulnerable libsoup builds, including Debian LTS
• Applications and services that route HTTP traffic through libsoup (GNOME desktop components, third-party clients and servers)

Discovery Timeline

• 2024-11-11 - CVE-2024-52530 published to the National Vulnerability Database (NVD)
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-52530

Vulnerability Analysis

The vulnerability stems from how libsoup parses HTTP header field names. RFC 7230 defines header field names as token characters, and embedded null bytes are not valid. libsoup strips or ignores trailing \0 bytes in header names instead of rejecting the request. A header sent as Transfer-Encoding\0: chunked is therefore normalized to Transfer-Encoding: chunked inside libsoup, while strict upstream or downstream HTTP parsers see a different, unrelated header name. This parser disagreement is the foundation of HTTP request smuggling.

When libsoup is paired with another HTTP implementation, such as a reverse proxy, content delivery network, or load balancer, the two systems can disagree on where one request ends and the next begins. An attacker who controls the body of a smuggled request can prepend arbitrary HTTP requests onto another user's connection, poison shared caches, capture authenticated requests, or bypass front-end access controls.

Root Cause

The root cause is improper input validation of HTTP header field names. libsoup accepts header names that contain or terminate with the null byte (\0) and treats them as equivalent to the cleaned name. Compliant HTTP parsers either reject these headers outright or treat them as distinct names. This inconsistent interpretation between cooperating HTTP intermediaries enables the smuggling primitive described in CWE-444.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP request containing a header name terminated with a null byte, such as Transfer-Encoding\0: chunked, to a deployment in which libsoup and a second HTTP implementation parse the same stream. The parsers disagree on framing, allowing the attacker to inject a hidden request that targets subsequent users, internal endpoints, or cached resources.

For concrete reproduction details and protocol-level examples, see GNOME libsoup Issue #377 and GNOME libsoup Merge Request #402.

Detection Methods for CVE-2024-52530

Indicators of Compromise

• HTTP requests or proxy logs containing header names with embedded or trailing null (\0, %00) bytes, particularly on framing headers such as Transfer-Encoding, Content-Length, and Host.
• Mismatches between front-end proxy and back-end application logs for the same connection, including unexpected request counts, paths, or methods.
• Cache entries or responses delivered to users that do not correspond to any request they issued.

Detection Strategies

• Inspect raw HTTP traffic at TLS termination points for non-token bytes in header field names and alert on any null byte appearing before the : separator.
• Compare access logs across the proxy chain to identify desynchronization, such as a single client connection producing more back-end requests than front-end requests.
• Inventory installed libsoup packages across Linux fleets and flag any version earlier than 3.6.0 for remediation.

Monitoring Recommendations

• Enable verbose HTTP parser logging on reverse proxies and web application firewalls and forward those events to a centralized analytics platform.
• Monitor for sudden changes in cache hit ratios, anomalous Set-Cookie responses on cached paths, and unexpected authenticated activity from shared egress IPs.
• Track Debian, GNOME, and downstream distribution security feeds, including the Debian LTS Announcement 2024-12, for additional advisories tied to libsoup.

How to Mitigate CVE-2024-52530

Immediate Actions Required

• Upgrade libsoup to version 3.6.0 or later on every host that ships or consumes the library.
• Apply distribution-provided security updates, including the patched packages described in the Debian LTS Announcement 2024-12.
• Restart all services that link against libsoup so that the patched library is loaded into running processes.

Patch Information

The upstream fix is tracked in GNOME libsoup Merge Request #402 and shipped in libsoup 3.6.0. The patch rejects HTTP header names that contain null bytes rather than silently normalizing them, restoring consistent parsing with RFC-compliant implementations. Additional vendor guidance is available on the GNOME Releng Security Wiki.

Workarounds

• Place a strict HTTP parser, such as a hardened reverse proxy or web application firewall, in front of libsoup-based services and configure it to reject any header name containing a null byte.
• Disable HTTP keep-alive on affected back-end services where feasible to reduce the window for connection-level smuggling.
• Restrict network exposure of services backed by vulnerable libsoup builds until patching is complete.

# Example: verify the installed libsoup version on Debian-based systems
dpkg -l | grep -E 'libsoup-?[23]'

# Upgrade to the patched package set
sudo apt update
sudo apt install --only-upgrade libsoup2.4-1 libsoup-3.0-0

# Restart services that link against libsoup
sudo systemctl restart <service-name>