Vulnetix
Try Vulnetix Request Demo
CVE-2026-2708 PUBLISHED CVSS 3.700000047683716 LOW

A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.

Risk Scores

CVSS v3.1
3.700000047683716
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected Products

VendorProductVersions
Red HatRed Hat Enterprise Linux 7
Red HatRed Hat Enterprise Linux 10
Red HatRed Hat Enterprise Linux 9
Red HatRed Hat Enterprise Linux 6
Red HatRed Hat Enterprise Linux 8

Timeline

References

Open in Interactive Console →