CVE-2026-66338

Name of the Vulnerable Software and Affected Versions libsoup (affected versions not specified)

Description A flaw exists in the chunked transfer encoding parser of libsoup. The parser uses a permissive function for chunk sizes that accepts inputs violating RFC 9112, such as leading whitespace, plus sign prefixes, and trailing invalid characters. This occurs within the soup body input stream read chunked() function. When libsoup is used behind a strict frontend proxy, this difference in parsing can be exploited to perform HTTP request smuggling, a technique where an attacker interferes with the way a website processes sequences of HTTP requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.