CVE-2026-103399 in Red Hat
Summary
by MITRE • 09/30/2026
A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled request, leading to unintended request handling.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in libsoup's SoupServer component represents a critical implementation flaw within the HTTP/1.x protocol handling logic, specifically concerning the interaction between header parsing and body consumption during 100-continue negotiations. This issue stems from a failure to properly manage connection state when an early final response is returned before the request body has been fully consumed by the application layer. In standard HTTP/1.1 operations using persistent connections, also known as keep-alive, it is imperative that servers either drain unread data from the input stream or terminate the TCP connection to prevent protocol confusion. When SoupServer encounters a scenario where an Expect: 100-continue header is present alongside a request body, and subsequently decides to return an immediate non-1xx response code without reading the payload, it leaves residual bytes in the socket buffer. These leftover bytes remain on the wire for subsequent processing cycles rather than being discarded or causing an error that closes the connection.
This behavior creates a direct pathway for HTTP Request Smuggling attacks, specifically falling under the category of CL.TE smuggling where Content-Length and Transfer-Encoding headers might be manipulated to confuse downstream proxies or mislead the server's own parser about message boundaries. A remote, unauthenticated attacker can exploit this by crafting a malicious request that includes an Expect header followed by a body containing another complete HTTP request. Because SoupServer fails to drain these bytes before sending its response, the next time it reads from the same keep-alive connection, it interprets the smuggled data as a new, legitimate incoming request. This allows the attacker to inject arbitrary commands or requests that bypass normal authentication and authorization checks if they are processed in a context where such controls were not applied to the initial outer request.
The operational impact of this vulnerability is severe, potentially leading to security bypasses, cache poisoning, cross-site scripting via injected responses, or unauthorized access to backend resources depending on how the smuggled requests are handled by downstream infrastructure or application logic. If SoupServer sits behind a reverse proxy that does not perform similar body draining checks, the discrepancy in request interpretation between the front-end and back-end can be exploited for more complex attacks such as HTTP Desync. The lack of automatic connection closure means that this vulnerability is particularly dangerous on high-traffic servers where keep-alive connections are frequently reused, increasing the likelihood of successful exploitation without requiring repeated new TCP handshakes which might trigger rate limiting or intrusion detection systems.
Mitigation strategies must focus on enforcing strict adherence to HTTP/1.x specifications regarding body consumption and connection management. The primary technical fix involves modifying SoupServer to ensure that any unread request body is fully drained from the socket buffer before sending a final response, regardless of whether an early decision was made not to process the payload further. Alternatively, if draining is deemed too costly for performance reasons in specific high-throughput scenarios, the server should explicitly close the TCP connection upon returning such responses to prevent subsequent requests on that same stream. Organizations relying on libsoup should apply vendor-provided patches immediately and review their deployment configurations to ensure no legacy versions are exposed to untrusted networks. Additionally, implementing Web Application Firewalls with HTTP desync detection capabilities can provide a layer of defense against exploitation attempts while internal remediation efforts are completed. This vulnerability aligns with CWE-20 Improper Input Validation as the server fails to validate and consume input correctly, and maps to MITRE ATT&CK technique T1534 Internal Service Scanning or potentially T1190 Exploit Public-Facing Application depending on the specific outcome of the smuggled request.