CVE-2026-2708

ℹ️ low

Summary

A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.

CVSS Score

3.7

Low

EPSS Score

0.0

Exploit Probability

Published Date

2026-04-23

First Seen: 2026-04-27

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 4.0% of all 322,079 vulnerabilities in our database.

#309,197

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Apr 24, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

Red Hat would like to thank Cavid for reporting this issue.

SSVC data provided by CISA

Last Modified 2026-05-04

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE IDs (Weakness Types)

CWE-444

📦 Affected Products 6

Vendor	Product	Status	Affected Versions
redhat	enterprise_linux	Affected	v10.0
redhat	enterprise_linux	Affected	v6.0
redhat	enterprise_linux	Affected	v7.0
redhat	enterprise_linux	Affected	v8.0
redhat	enterprise_linux	Affected	v9.0
gnome	libsoup	Affected	v-

🔗 References 4

https://access.redhat.com/security/cve/CVE-2026-2708

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2440743

Issue Tracking Vendor Advisory

https://gitlab.gnome.org/GNOME/libsoup/-/issues/500

Exploit Issue Tracking Vendor Advisory

https://gitlab.gnome.org/GNOME/libsoup/-/merge_reque...

Issue Tracking

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-42010	⚠️ high	7.1	0.2	A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully ma...	2026-05-07
CVE-2026-34000	🔶 medium	6.1	0.0	A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifical...	2026-05-05
CVE-2026-34002	🔶 medium	6.1	0.0	A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension...	2026-05-05
CVE-2026-33845	⚠️ high	7.5	0.0	A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an i...	2026-04-30
CVE-2026-3832	ℹ️ low	3.7	0.0	A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online ...	2026-04-30
CVE-2026-3833	🔶 medium	6.5	0.1	A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstra...	2026-04-30

These CVEs affect the same products