CVE-2026-1760CWE-444

Libsoup: soupserver: denial of service via http request smuggling

Medium · published February 2, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
40.5
In the wild
Unconfirmed
What it is

A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine Transfer-Encoding: chunked and Connection: keep-alive headers. A remote, unauthenticated client can exploit this by sending specially crafted requests, causing SoupServer to fail to close the connection as required by RFC 9112. This allows the attacker to smuggle additional requests over the persistent connection, leading to unintended request processing and potential denial-of-service (DoS) conditions.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00480 · 40.5th percentile
Weakness
CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2026-02-02T14:01Z
EPSS history
Timeline
  • 02 FEB 14:01Z
    Libsoup: soupserver: denial of service via http request smuggling
    cvelistv5