CVE-2026-1801: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-1801 is an HTTP Request Smuggling vulnerability in libsoup, the GNOME HTTP client/server library, caused by non-RFC-compliant parsing of chunked transfer encoding headers. The flaw exists in the soup_filter_input_stream_read_line() function, which incorrectly accepts lone line feed (LF \n) characters in place of the required carriage return + line feed (CRLF \r\n) sequence mandated by RFC 9112. It affects GNOME libsoup (all versions tracked under CPE) and Red Hat Enterprise Linux versions 6.0 through 10.0. Disclosed on February 3, 2026, it carries a CVSS v3.1 base score of 6.5 (Medium/High) per Feedly/Red Hat, with some sources scoring it as low as 5.3 (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests — HTTP Request Smuggling). The vulnerable function soup_filter_input_stream_read_line() in libsoup's chunked transfer encoding parser fails to enforce strict CRLF line termination as required by RFC 9112, instead accepting malformed chunk headers containing lone LF characters. An unauthenticated remote attacker can exploit this by sending a single specially crafted HTTP request with malformed chunked encoding, causing libsoup to interpret it as multiple distinct HTTP requests — a classic request smuggling primitive. No authentication or user interaction is required, and the attack vector is entirely network-based (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation can lead to information disclosure and integrity violations, as an attacker can manipulate how HTTP requests are parsed and processed by the server, potentially bypassing security controls or poisoning shared request queues. The CVSS assessment reflects low confidentiality and low integrity impact with no availability impact. The practical risk is somewhat limited because SoupServer is not commonly deployed in internet-facing infrastructure, reducing the overall attack surface (Red Hat Bugzilla, Red Hat CVE).

1. Reconnaissance: Identify services using libsoup as their HTTP library (e.g., GNOME-based applications, embedded systems, or Linux services using SoupServer) via network scanning or application fingerprinting.
2. Craft malformed chunked request: Construct an HTTP/1.1 request using chunked transfer encoding where chunk size headers are terminated with a lone LF (\n) instead of CRLF (\r\n), embedding a second hidden HTTP request within the body.
3. Send the smuggled request: Transmit the crafted request to the target libsoup-based server without any authentication. The malformed chunk header causes libsoup's soup_filter_input_stream_read_line() to misparse the message boundary.
4. Trigger request smuggling: libsoup processes the embedded second request as a separate, legitimate HTTP request, potentially targeting internal endpoints, bypassing access controls, or poisoning shared state.
5. Achieve objective: Depending on the application context, the attacker may access restricted resources, exfiltrate sensitive response data intended for another user, or manipulate server-side logic (Red Hat Bugzilla).

• Network: Unusual HTTP/1.1 chunked requests where chunk size lines are terminated with bare \n instead of \r\n; unexpected sequences of HTTP requests arriving from a single TCP connection that do not align with normal application flow.
• Logs: Web server or application logs showing unexpected or duplicate request processing from a single connection; requests to internal or restricted endpoints that were not directly initiated by a client.
• Process/Application: Anomalous application behavior such as responses being served to the wrong client session, or unexpected access to protected resources without corresponding authentication events.

Patches have been released by multiple downstream vendors: SUSE issued advisory SUSE-SU-2026:2314-1 for libsoup, Amazon Linux 2023 released ALAS2023-2026-1758 and ALAS2023-2026-1778, and openSUSE published corresponding security announcements. Red Hat has tracked the issue in Bugzilla (Bug 2436315) and the fix is available via standard RHEL update channels. Users should update libsoup to the patched version provided by their distribution as the primary remediation. As a workaround where patching is not immediately possible, consider restricting network access to services using SoupServer and deploying a reverse proxy or WAF that enforces strict RFC 9112 CRLF compliance on chunked encoding headers (Red Hat CVE, SUSE Advisory, Amazon Linux).

The vulnerability was reported with low-to-medium severity by Red Hat, noting that practical exploitation risk is reduced because SoupServer is not commonly used in internet-facing infrastructure. The Yocto Project security mailing list discussed the issue across multiple messages, indicating awareness in the embedded Linux community. No significant public researcher commentary or media coverage beyond standard vulnerability database entries has been identified (Red Hat Bugzilla, Yocto Security List).