CyberRota Analysis
AI-GeneratedA vulnerability exists in the chunked transfer encoding parser of libsoup, which improperly handles chunk sizes by allowing inputs that violate RFC 9112, such as leading whitespace and invalid characters. This flaw can be exploited to smuggle HTTP requests when libsoup is used behind a strict frontend proxy, potentially leading to unauthorized access or data manipulation. Organizations utilizing libsoup in their applications should prioritize remediation to mitigate the risk of HTTP request smuggling attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests.