CVE-2026-1760: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-1760 is an HTTP request smuggling vulnerability in GNOME's libsoup library, specifically affecting the SoupServer component. The flaw arises from improper handling of HTTP requests that combine Transfer-Encoding: chunked and Connection: keep-alive headers, causing the server to violate RFC 9112 by failing to close the connection after responding. This allows unauthenticated remote attackers to smuggle additional requests over persistent connections, leading to unintended request processing and potential denial-of-service (DoS) conditions. It was disclosed on February 2, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling). While SoupServer correctly ignores the Content-Length header when Transfer-Encoding: chunked is present, it fails to close the TCP connection after sending its response as required by RFC 9112. This leaves residual chunked data in the connection buffer, which the server then processes as a new, subsequent HTTP request. Exploitation requires no authentication, no user interaction, and is achievable over the network with low attack complexity (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation primarily affects availability, with a low availability impact rating under CVSS v3.1. An unauthenticated remote attacker can cause unintended request processing on the server by smuggling additional HTTP requests over a persistent connection, potentially leading to DoS conditions. There is no assessed impact on confidentiality or integrity based on current analysis, and the scope is unchanged, limiting blast radius to the affected SoupServer instance (Red Hat CVE, Red Hat Bugzilla).

1. Reconnaissance: Identify services running libsoup's SoupServer component on target systems using network scanning tools (e.g., Nmap with HTTP service fingerprinting).
2. Craft smuggling request: Construct an HTTP request that includes both Transfer-Encoding: chunked and Connection: keep-alive headers, with a chunked body followed by a smuggled secondary HTTP request embedded in the trailing data.
3. Send request: Transmit the crafted request to the target SoupServer endpoint over a persistent TCP connection.
4. Trigger processing: Because SoupServer fails to close the connection after responding (violating RFC 9112), the residual chunked data is interpreted as a new HTTP request, causing unintended server-side request processing.
5. Achieve DoS: Repeat the process to exhaust server resources or cause erroneous request handling, resulting in denial-of-service conditions (Red Hat Bugzilla).

• Network: Unusual persistent HTTP connections to services using libsoup, particularly requests containing both Transfer-Encoding: chunked and Connection: keep-alive headers; anomalous HTTP request sequences on a single TCP connection.
• Logs: Server access logs showing unexpected or duplicate request processing from a single connection; HTTP 400 or 500 errors following malformed chunked requests; unusual request patterns from a single source IP.
• Process: Elevated CPU or memory usage in processes linked to libsoup (libsoup-3.0, libsoup-2.4) without a corresponding increase in legitimate traffic.

The vulnerability has been patched in libsoup, with fixes tracked via Red Hat Bugzilla bug 2435951. Affected distributions including SUSE/openSUSE and Amazon Linux 2023 have released updated packages (e.g., Amazon Linux 2023 advisories ALAS2023-2026-1758 and ALAS2023-2026-1778). Users should update libsoup to the latest patched version available for their distribution as the primary remediation. No specific configuration-based workaround has been publicly documented; upgrading is the recommended action (Red Hat Bugzilla, Red Hat CVE).

Coverage of CVE-2026-1760 has been limited to standard vulnerability aggregation and advisory channels, including Tenable Nessus plugin releases, openSUSE security announcements, and Linux security news outlets. A technical write-up was published by infinitsec.net specifically covering the libsoup SoupServer DoS via HTTP request smuggling. No notable researcher commentary or significant social media discussion has been identified beyond routine vulnerability tracking.