Описание
Security update for libsoup2
This update for libsoup2 fixes the following issues:
- CVE-2026-1801: Use CRLF as line boundary when parsing chunk encoding data (bsc#1257649).
Список пакетов
openSUSE Leap 16.0
libsoup-2_4-1-2.74.3-160000.5.1
libsoup2-devel-2.74.3-160000.5.1
libsoup2-lang-2.74.3-160000.5.1
typelib-1_0-Soup-2_4-2.74.3-160000.5.1
Ссылки
- SUSE Security Ratings
- SUSE Bug 1257649
- SUSE CVE CVE-2026-1801 page
Описание
A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or user interaction by sending specially crafted chunked requests. This allows libsoup to parse and process multiple HTTP requests from a single network message, potentially leading to information disclosure.
Затронутые продукты
openSUSE Leap 16.0:libsoup-2_4-1-2.74.3-160000.5.1
openSUSE Leap 16.0:libsoup2-devel-2.74.3-160000.5.1
openSUSE Leap 16.0:libsoup2-lang-2.74.3-160000.5.1
openSUSE Leap 16.0:typelib-1_0-Soup-2_4-2.74.3-160000.5.1
Ссылки
- CVE-2026-1801
- SUSE Bug 1257649