CVE-2026-1760: SoupServer HTTP Request Smuggling DoS Flaw

CVE-2026-1760 Overview

A flaw was found in SoupServer that enables HTTP request smuggling attacks. This vulnerability occurs because SoupServer improperly handles requests that combine Transfer-Encoding: chunked and Connection: keep-alive headers. A remote, unauthenticated client can exploit this by sending specially crafted requests, causing SoupServer to fail to close the connection as required by RFC 9112. This allows the attacker to smuggle additional requests over the persistent connection, leading to unintended request processing and potential denial-of-service (DoS) conditions.

Critical Impact

Remote attackers can exploit this HTTP request smuggling vulnerability to smuggle malicious requests over persistent connections, potentially causing service disruption or enabling further attacks on backend systems.

Affected Products

• SoupServer (libsoup HTTP server component)
• Applications and services utilizing SoupServer for HTTP request handling
• GNOME-based applications leveraging libsoup networking libraries

Discovery Timeline

• February 2, 2026 - CVE-2026-1760 published to NVD
• February 3, 2026 - Last updated in NVD database

Technical Details for CVE-2026-1760

Vulnerability Analysis

This vulnerability is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests, also known as HTTP Request Smuggling). The flaw exists in how SoupServer processes incoming HTTP requests that utilize chunked transfer encoding alongside persistent connections.

When a client sends a request with both Transfer-Encoding: chunked and Connection: keep-alive headers, SoupServer fails to properly terminate the connection under conditions mandated by RFC 9112. This RFC specifies strict requirements for handling chunked encoding in HTTP/1.1, particularly regarding when connections must be closed to prevent request boundary confusion.

The improper connection handling creates an opportunity for attackers to inject additional HTTP requests into the persistent connection stream. These smuggled requests may be processed with unintended context, potentially bypassing security controls or causing the server to enter an inconsistent state.

Root Cause

The root cause stems from SoupServer's non-compliant implementation of RFC 9112 connection management. Specifically, the server does not properly enforce connection closure requirements when processing chunked transfer-encoded requests. This implementation gap allows the connection to remain open when it should be terminated, enabling request desynchronization between the client and server's interpretation of request boundaries.

Attack Vector

The attack can be executed remotely over the network by an unauthenticated attacker. The exploitation process involves:

1. The attacker establishes a persistent connection to the vulnerable SoupServer instance
2. A specially crafted HTTP request is sent combining Transfer-Encoding: chunked with Connection: keep-alive headers
3. Due to improper connection handling, SoupServer fails to close the connection as required
4. The attacker appends additional malicious requests that get smuggled through the persistent connection
5. These smuggled requests are processed out of context, potentially causing denial of service or enabling secondary attacks

The vulnerability mechanism exploits the discrepancy between how the server interprets chunked request boundaries versus how the connection lifecycle should be managed according to HTTP specifications. Attackers craft requests where the apparent end of one request, as interpreted by chunked encoding parsing, differs from where the server believes the request stream should terminate.

Detection Methods for CVE-2026-1760

Indicators of Compromise

• Unusual patterns of persistent HTTP connections with malformed or ambiguous chunked encoding
• Unexpected HTTP requests appearing in server logs without corresponding client-initiated sessions
• Evidence of duplicate or out-of-sequence request processing in application logs
• Connection anomalies where keep-alive connections persist longer than expected

Detection Strategies

• Deploy network traffic analysis to identify HTTP requests with suspicious combinations of Transfer-Encoding and Connection headers
• Implement deep packet inspection rules to detect potential request smuggling patterns in HTTP traffic
• Monitor SoupServer logs for signs of request desynchronization or unexpected request sequences
• Configure web application firewalls (WAF) to flag requests with ambiguous transfer encoding specifications

Monitoring Recommendations

• Enable verbose logging on SoupServer instances to capture detailed request header information
• Set up alerting for anomalous connection behavior patterns on services using libsoup
• Monitor system resources for signs of DoS conditions resulting from request smuggling exploitation
• Review application logs regularly for evidence of unintended request processing

How to Mitigate CVE-2026-1760

Immediate Actions Required

• Review deployed applications for SoupServer/libsoup usage and assess exposure
• Implement network-level filtering to restrict access to affected services where possible
• Deploy web application firewall rules to detect and block potential request smuggling attempts
• Monitor affected systems closely for signs of exploitation while awaiting patches

Patch Information

Consult the Red Hat CVE Advisory for the latest patch information and affected package versions. Additional technical details are available in Red Hat Bug Report #2435951. Apply vendor-provided security updates as soon as they become available for your distribution.

Workarounds

• Consider disabling persistent connections (keep-alive) on affected SoupServer instances if operationally feasible
• Deploy a reverse proxy in front of SoupServer that properly normalizes HTTP requests before forwarding
• Implement strict request validation at the application layer to reject ambiguous header combinations
• Restrict network access to affected services to trusted clients only until patches are applied

# Example: Configure reverse proxy to normalize requests (nginx example)
# Add to server block configuration to disable chunked transfer encoding passthrough
proxy_http_version 1.1;
proxy_set_header Connection "";
chunked_transfer_encoding off;