Описание
Security update for libsoup
This update for libsoup fixes the following issues
- CVE-2026-1801: HTTP Request Smuggling in soup_filter_input_stream_read_line() (bsc#1257649).
- CVE-2026-4271: use-after-free in the HTTP/2 server when user signal handlers disconnect connections during callback execution (bsc#1259767).
Список пакетов
SUSE Linux Enterprise Module for Basesystem 15 SP7
SUSE Linux Enterprise Server 15 SP6-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP6
Ссылки
- Link for SUSE-SU-2026:2314-1
- E-Mail link for SUSE-SU-2026:2314-1
- SUSE Security Ratings
- SUSE Bug 1257649
- SUSE Bug 1259767
- SUSE CVE CVE-2026-1801 page
- SUSE CVE CVE-2026-4271 page
Описание
A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or user interaction by sending specially crafted chunked requests. This allows libsoup to parse and process multiple HTTP requests from a single network message, potentially leading to information disclosure.
Затронутые продукты
Ссылки
- CVE-2026-1801
- SUSE Bug 1257649
Описание
A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by sending specially crafted HTTP/2 requests that cause authentication failures. This can lead to the application attempting to access memory that has already been freed, potentially causing application instability or crashes, resulting in a Denial of Service (DoS).
Затронутые продукты
Ссылки
- CVE-2026-4271
- SUSE Bug 1259767