CVE-2026-2708: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-2708 is an HTTP Request Smuggling vulnerability in GNOME libsoup's HTTP/1 header parsing logic, classified under CWE-444. The flaw resides in the soup_message_headers_append_common() function in libsoup/soup-message-headers.c, which unconditionally appends header values without validating for duplicate or conflicting Content-Length fields, allowing attackers to send requests with multiple differing Content-Length headers. Affected products include GNOME libsoup (all versions) and Red Hat Enterprise Linux versions 6.0, 7.0, 8.0, 9.0, and 10.0. The vulnerability was reported on February 18, 2026, and publicly disclosed on April 23, 2026. CVSS v3.1 scores vary by source: NVD assigns 5.3 (Medium) while GitHub Advisory and ENISA assign 3.7 (Low) (Github Advisory, Red Hat Bugzilla, Red Hat Advisory).

The root cause is CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling). The vulnerable function soup_message_headers_append_common() in libsoup/soup-message-headers.c appends each incoming header value to an internal list without checking whether a Content-Length header already exists or whether multiple Content-Length values conflict. When libsoup acts as an intermediary or is used in a pipeline with other HTTP components (e.g., proxies, load balancers), differing interpretations of which Content-Length value is authoritative can cause request boundary desynchronization. No authentication or user interaction is required to trigger the flaw; an attacker only needs network access to send a crafted HTTP/1 request (Github Advisory, Red Hat Bugzilla, GNOME GitLab).

Successful exploitation can allow an attacker to bypass security controls, poison HTTP caches, or inject malicious content into responses seen by other users sharing the same HTTP pipeline. The primary impact is on integrity (Low), with no direct confidentiality or availability impact per the CVSS scoring. In multi-tier architectures where libsoup intermediates between clients and backend services, request smuggling could enable unauthorized access to backend resources, session hijacking, or cross-user data injection (Github Advisory, Red Hat Advisory).

A proof-of-concept is publicly referenced via the GNOME GitLab issue tracker, but there is no evidence of active in-the-wild exploitation as of the latest update (GNOME GitLab). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.029–0.052%, placing it in a low exploitation probability range. No threat actor attribution has been reported (Github Advisory).

1. Reconnaissance: Identify applications or services using libsoup as their HTTP client/server library, particularly those deployed behind proxies or load balancers on Red Hat Enterprise Linux or GNOME-based systems.
2. Craft malicious HTTP request: Construct an HTTP/1.1 request containing two Content-Length headers with differing values, e.g.:

POST /api/endpoint HTTP/1.1
Host: target.example.com
Content-Length: 10
Content-Length: 50

SMUGGLED

3. Send request to target: Transmit the crafted request to the libsoup-based server or through a proxy that forwards to a libsoup backend. The front-end component uses one Content-Length value while libsoup uses the other, causing request boundary desynchronization.
4. Exploit desynchronization: Leverage the smuggled request prefix to prepend attacker-controlled data to the next legitimate user's request, enabling cache poisoning, session hijacking, or injection of malicious content into subsequent responses (GNOME GitLab, Github Advisory).

• Network: HTTP/1.1 requests containing multiple Content-Length headers with differing values directed at libsoup-based services; unexpected or malformed request sequences observed at proxy or load balancer logs.
• Logs: Web server or proxy access logs showing requests with duplicate Content-Length headers; anomalous request sequencing where one client's request appears to contain data from another client's session.
• Application Behavior: Unexpected responses served to users that contain content from other users' requests; cache entries containing injected or unexpected content not matching the original request.

Patches are available through GNOME GitLab (merge request !513) and via Red Hat security advisories for RHEL 6.0 through 10.0 (GNOME GitLab, Red Hat Advisory). Organizations should update libsoup to the patched version provided by their distribution (e.g., via dnf update libsoup on RHEL). As a temporary workaround, configure upstream proxies or load balancers to reject or normalize HTTP requests containing duplicate or conflicting Content-Length headers before they reach libsoup-dependent applications. Amazon Linux 2023 users should apply the update referenced in ALAS2023-2026-1778, and openSUSE/SUSE users should apply the relevant security announcements.

The vulnerability has been tracked across multiple Linux distribution security channels including openSUSE, SUSE, Amazon Linux, and Yocto Project security mailing lists, indicating broad ecosystem awareness. Pro-Linux.de and LinuxCompatible.org have published multiple advisories covering libsoup and libsoup2 updates referencing this CVE. No notable individual researcher commentary or significant social media discussion has been identified beyond standard distribution security update announcements (Github Advisory, Red Hat Advisory).