CVE catalog

CVE-2026-1801

libsoup vulnerabilities

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.43% · Oct 25, 2026

A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or user interaction by sending specially crafted chunked requests. This allows libsoup to parse and process multiple HTTP requests from a single network message, potentially leading to information disclosure.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibsoup3sid3.8.0-3fixed
Debianlibsoup3forky3.8.0-3fixed
Debianlibsoup3trixie3.6.5-3vulnerable
Debianlibsoup3bookworm3.2.3-0+deb12u2vulnerable
Debianlibsoup2.4trixie2.74.3-10.1vulnerable
Debianlibsoup2.4bookworm2.74.3-1+deb12u1vulnerable
Ubuntulibsoup2.4nobleNot reportedvulnerable
Ubuntulibsoup3nobleNot reportedvulnerable
Ubuntulibsoup2.4noble2.74.3-6ubuntu1.8fixed
Ubuntulibsoup3noble3.4.4-5ubuntu0.8fixed
Ubuntugir1.2-soup-2.4noble2.74.3-6ubuntu1.8fixed
Ubuntugir1.2-soup-3.0noble3.4.4-5ubuntu0.8fixed
Ubuntulibsoup-2.4-1noble2.74.3-6ubuntu1.8fixed
Ubuntulibsoup-3.0-0noble3.4.4-5ubuntu0.8fixed
Ubuntulibsoup-3.0-commonnoble3.4.4-5ubuntu0.8fixed
Ubuntulibsoup-3.0-devnoble3.4.4-5ubuntu0.8fixed
Ubuntulibsoup-3.0-docnoble3.4.4-5ubuntu0.8fixed
Ubuntulibsoup-3.0-testsnoble3.4.4-5ubuntu0.8fixed
Ubuntulibsoup-gnome-2.4-1noble2.74.3-6ubuntu1.8fixed
Ubuntulibsoup-gnome2.4-devnoble2.74.3-6ubuntu1.8fixed
Ubuntulibsoup2.4-commonnoble2.74.3-6ubuntu1.8fixed
Ubuntulibsoup2.4-devnoble2.74.3-6ubuntu1.8fixed
Ubuntulibsoup2.4-docnoble2.74.3-6ubuntu1.8fixed
Ubuntulibsoup2.4-testsnoble2.74.3-6ubuntu1.8fixed
Suselibsouplinux enterprise server ltss extended security 12 sp52.62.2-5.43.1fixed
Suselibsoup2linux enterprise micro 5.32.74.2-150400.3.37.1fixed
Suselibsoup2linux enterprise micro 5.42.74.2-150400.3.37.1fixed
Suselibsoup2linux enterprise micro 5.52.74.2-150400.3.37.1fixed
Suselibsoup2linux enterprise module for basesystem 15 sp72.74.3-150600.4.36.1fixed
Suselibsouplinux micro 6.03.4.2-16.1fixed
Suselibsouplinux micro 6.13.4.4-slfo.1.1_10.1fixed
Suselibsouplinux enterprise module for basesystem 15 sp73.4.4-150600.3.47.1fixed
Suselibsouplinux enterprise server 15 sp6-ltss3.4.4-150600.3.47.1fixed
Suselibsouplinux enterprise server for sap applications 15 sp63.4.4-150600.3.47.1fixed
Opensuselibsoup2tumbleweed2.74.3-21.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibsoup3sourcesid3.6.5-8not yet assignedNot reportedNot reported
Debianlibsoup3sourceforky3.6.5-8not yet assignedNot reportedNot reported
Debianlibsoup3sourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianlibsoup3sourcebookworm(unfixed)not yet assignedNot reportedNot reported
Debianlibsoup2.4sourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianlibsoup2.4sourcebookworm(unfixed)not yet assignedNot reportedNot reported
Ubuntulibsoup2.4debnoble2.74.3-6ubuntu1.8Not reportedNot reportedNot reported
Ubuntulibsoup3debnoble3.4.4-5ubuntu0.8Not reportedNot reportedNot reported
Ubuntugir1.2-soup-2.4debnoble2.74.3-6ubuntu1.8Not reportedNot reportedNot reported
Ubuntugir1.2-soup-3.0debnoble3.4.4-5ubuntu0.8Not reportedNot reportedNot reported
Ubuntulibsoup-2.4-1debnoble2.74.3-6ubuntu1.8Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-0debnoble3.4.4-5ubuntu0.8Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-commondebnoble3.4.4-5ubuntu0.8Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-devdebnoble3.4.4-5ubuntu0.8Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-docdebnoble3.4.4-5ubuntu0.8Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-testsdebnoble3.4.4-5ubuntu0.8Not reportedNot reportedNot reported
Ubuntulibsoup-gnome-2.4-1debnoble2.74.3-6ubuntu1.8Not reportedNot reportedNot reported
Ubuntulibsoup-gnome2.4-devdebnoble2.74.3-6ubuntu1.8Not reportedNot reportedNot reported
Ubuntulibsoup2.4-commondebnoble2.74.3-6ubuntu1.8Not reportedNot reportedNot reported
Ubuntulibsoup2.4-devdebnoble2.74.3-6ubuntu1.8Not reportedNot reportedNot reported
Ubuntulibsoup2.4-docdebnoble2.74.3-6ubuntu1.8Not reportedNot reportedNot reported
Ubuntulibsoup2.4-testsdebnoble2.74.3-6ubuntu1.8Not reportedNot reportedNot reported
Suselibsouprpmlinux enterprise server ltss extended security 12 sp52.62.2-5.43.1Not reportedSUSE-SU-2026:2702-1Not reported
Suselibsoup2rpmlinux enterprise micro 5.32.74.2-150400.3.37.1Not reportedSUSE-SU-2026:2670-1Not reported
Suselibsoup2rpmlinux enterprise micro 5.42.74.2-150400.3.37.1Not reportedSUSE-SU-2026:2670-1Not reported
Suselibsoup2rpmlinux enterprise micro 5.52.74.2-150400.3.37.1Not reportedSUSE-SU-2026:2670-1Not reported
Suselibsoup2rpmlinux enterprise module for basesystem 15 sp72.74.3-150600.4.36.1Not reportedSUSE-SU-2026:2654-1Not reported
Suselibsouprpmlinux micro 6.03.4.2-16.1Not reportedSUSE-SU-2026:22061-1Not reported
Suselibsouprpmlinux micro 6.13.4.4-slfo.1.1_10.1Not reportedSUSE-SU-2026:22071-1Not reported
Suselibsouprpmlinux enterprise module for basesystem 15 sp73.4.4-150600.3.47.1Not reportedSUSE-SU-2026:2314-1Not reported
Suselibsouprpmlinux enterprise server 15 sp6-ltss3.4.4-150600.3.47.1Not reportedSUSE-SU-2026:2314-1Not reported
Suselibsouprpmlinux enterprise server for sap applications 15 sp63.4.4-150600.3.47.1Not reportedSUSE-SU-2026:2314-1Not reported
Opensuselibsoup2rpmtumbleweed2.74.3-21.1Not reportedOPENSUSE-SU-2026:10917-1Not reported

Notes

[trixie] libsoup3: Minor issue [bookworm] libsoup3: Minor issue [trixie] libsoup2.4: Minor issue [bookworm] libsoup2.4: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [gir1.2-soup-2.4]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

  • [gir1.2-soup-3.0]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

  • [libsoup2.4-1]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

  • [libsoup2.4-common]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · all · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · all · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

  • [libsoup2.4-dev]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

  • [libsoup2.4-doc]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · all · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · all · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

  • [libsoup2.4-tests]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

  • [libsoup-3.0-0]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

  • [libsoup-3.0-common]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

  • [libsoup-3.0-dev]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

  • [libsoup-3.0-doc]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

  • [libsoup-3.0-tests]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

  • [libsoup-gnome2.4-1]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

  • [libsoup-gnome2.4-dev]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

[Debian 13 (Trixie)]

  • [gir1.2-soup-2.4]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-10.1 · amd64 · trixie

      Affected

      usn · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · arm64 · trixie

      Affected

      usn · libsoup2.4 · debian · 13

  • [gir1.2-soup-3.0]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.6.5-3 · amd64 · trixie

      Affected

      usn · libsoup3 · debian · 13

    • 3.6.5-3 · arm64 · trixie

      Affected

      usn · libsoup3 · debian · 13

  • [libsoup-2.4-1]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-10.1 · amd64 · trixie

      Affected

      usn · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · arm64 · trixie

      Affected

      usn · libsoup2.4 · debian · 13

  • [libsoup2.4-common]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-10.1 · all · trixie

      Affected

      usn · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · all · trixie

      Affected

      usn · libsoup2.4 · debian · 13

  • [libsoup2.4-dev]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-10.1 · amd64 · trixie

      Affected

      usn · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · arm64 · trixie

      Affected

      usn · libsoup2.4 · debian · 13

  • [libsoup2.4-doc]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-10.1 · all · trixie

      Affected

      usn · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · all · trixie

      Affected

      usn · libsoup2.4 · debian · 13

Next results

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]