REDHAT-BUG-2506950: Low severity Gnome libsoup vulnerability
The chunked transfer encoding parser in libsoup uses strtoul(metabuf, NULL, 16) to parse chunk sizes without strict validation. This function silently accepts inputs that violate RFC 9112 §7.1, including leading whitespace, + prefixes, and trailing invalid characters (e.g., 0z parses as 0). When libsoup operates behind a strict frontend proxy, this parsing differential enables an attacker to smuggle HTTP requests through the backend connection. Both server-side (SoupServer) and client-side chunked response parsing are affected. This is distinct from CVE-2026-1801 which covers bare LF tolerance.
Upstream report: https://gitlab.gnome.org/GNOME/libsoup/-/workitems/533 PSIRTSUPT: https://redhat.atlassian.net/browse/PSIRTSUPT-17666
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Deploy/use a strict frontend proxy that enforces RFC 9112 §7.1 chunk-size syntax (reject chunk-size values with leading whitespace, a leading '+' prefix, and any trailing invalid characters) so that malformed chunk sizes cannot be interpreted by the backend libsoup parser.