CVE-2026-103399
Description
A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled request, leading to unintended request handling.
Statement
A moderate-impact HTTP/1 request-smuggling flaw exists in SoupServer when an early final response is sent for an Expect: 100-continue request whose body has not been consumed. Leftover body bytes on a reused connection can be dispatched as a new request, violating HTTP/1.1 message framing (RFC 9112). Impact is limited for typical SoupServer use: the API is intended for lightweight internal, development, or testing servers rather than hardened internet-facing deployments. Cross-client request smuggling would require a reverse proxy that pools or reuses the backend connection across clients; that scenario is not the common Red Hat deployment model for SoupServer.
Mitigation
To mitigate this do not expose SoupServer to untrusted networks; prefer terminating proxies or internal-only listeners. If SoupServer must sit behind a reverse proxy, disable backend connection reuse/pooling across clients so an undrained body cannot prepend to another client's request.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 5.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Understanding the Weakness (CWE)
Integrity,Non-Repudiation,Access Control
Technical Impact: Unexpected State; Hide Activities; Bypass Protection Mechanism
An attacker could create HTTP messages to exploit a number of weaknesses including 1) the message can trick the web server to associate a URL with another URL's webpage and caching the contents of the webpage (web cache poisoning attack), 2) the message can be structured to bypass the firewall protection mechanisms and gain unauthorized access to a web application, and 3) the message can invoke a script or a page that returns client credentials (similar to a Cross Site Scripting attack).
Acknowledgements
Red Hat would like to thank Jianqiang (Stark) Li for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
