Medium [CVE-2026-6324] Libsoup: libsoup: http request smuggling via unsigned to signed conversion error

A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the `soup_body_input_stream_read_chunked()` function by sending a malicious HTTP request.

This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.

This vulnerability is rated Moderate due to the specialized network architecture and HTTP keep-alive connection reuse required to facilitate request smuggling. In standard Red Hat deployments, libsoup is primarily utilized as a client-side HTTP library by desktop and system utilities rather than as a public-facing server or reverse proxy.

Successful exploitation requires an atypical topology where a libsoup-based service processes pipelined requests behind or in front of an external proxy server with differing chunk-parsing logic. Red Hat severity: Moderate — CVSS 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

Weakness: CWE-444. Under investigation: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.