Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:2654-1

Опубликовано: 26 июн. 2026
Источник: suse-cvrf

Описание

Security update for libsoup2

This update for libsoup2 fixes the following issue

  • CVE-2026-1801: HTTP Request Smuggling in soup_filter_input_stream_read_line() (bsc#1257649).

Список пакетов

SUSE Linux Enterprise Module for Basesystem 15 SP7
libsoup-2_4-1-2.74.3-150600.4.36.1
libsoup2-devel-2.74.3-150600.4.36.1
libsoup2-lang-2.74.3-150600.4.36.1
typelib-1_0-Soup-2_4-2.74.3-150600.4.36.1

Ссылки

Описание

A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or user interaction by sending specially crafted chunked requests. This allows libsoup to parse and process multiple HTTP requests from a single network message, potentially leading to information disclosure.

Затронутые продукты
SUSE Linux Enterprise Module for Basesystem 15 SP7:libsoup-2_4-1-2.74.3-150600.4.36.1
SUSE Linux Enterprise Module for Basesystem 15 SP7:libsoup2-devel-2.74.3-150600.4.36.1
SUSE Linux Enterprise Module for Basesystem 15 SP7:libsoup2-lang-2.74.3-150600.4.36.1
SUSE Linux Enterprise Module for Basesystem 15 SP7:typelib-1_0-Soup-2_4-2.74.3-150600.4.36.1
Ссылки