CVE-2026-6324— Libsoup: libsoup: http request smuggling via unsigned to signed conversion error
Possible ATT&CK Techniques 2AI
T1557 · Adversary-in-the-Middle T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 5
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | any | unknown |
| Red Hat | Red Hat Enterprise Linux 6 | any | unknown |
| Red Hat | Red Hat Enterprise Linux 7 | any | unknown |
| Red Hat | Red Hat Enterprise Linux 8 | any | unknown |
| Red Hat | Red Hat Enterprise Linux 9 | any | unknown |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-6324
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Libsoup: libsoup: http request smuggling via unsigned to signed conversion error
Source: NVD (National Vulnerability Database)
Vulnerability Description
A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the `soup_body_input_stream_read_chunked()` function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
HTTP请求的解释不一致性(HTTP请求私运)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - | cpe:/o:redhat:enterprise_linux:10 | |
| Red Hat | Red Hat Enterprise Linux 6 | - | cpe:/o:redhat:enterprise_linux:6 | |
| Red Hat | Red Hat Enterprise Linux 7 | - | cpe:/o:redhat:enterprise_linux:7 | |
| Red Hat | Red Hat Enterprise Linux 8 | - | cpe:/o:redhat:enterprise_linux:8 | |
| Red Hat | Red Hat Enterprise Linux 9 | - | cpe:/o:redhat:enterprise_linux:9 |
II. Public POCs for CVE-2026-6324
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-6324
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-6324 (1)
Vendor Advisories for CVE-2026-6324 (1)
Other References for CVE-2026-6324 (1)
Same Patch Batch · Red Hat · 2026-05-29 · 6 CVEs total
| CVE-2026-42965 | 7.7 HIGH | Openshift/router: openshift/router: cloud metadata ssrf via fqdn-typed endpointslice bypas |
| CVE-2026-46579 | 7.4 HIGH | Openshift/router: openshift/router: mtls client certificate spoofing via unstripped x-ssl- |
| CVE-2026-10101 | 6.3 MEDIUM | Assisted-service: assisted-service: infraenv status leaks referenced pull-secret contents |
| CVE-2026-10052 | 4.1 MEDIUM | Quay/config-tool: quay/config-tool: ssrf via unfiltered ldap and smtp config validation en |
| CVE-2026-10078 | 2.7 LOW | Quay/config-tool: quay/config-tool: gitlab oauth client_secret exposed in url querystring |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
- CVE-2026-10028
Glib-networking: infinite loop in glib-networking gnutls bac - CVE-2026-4408
Samba: remote code execution in samr - CVE-2026-1933
Samba: missing access check on reparse point operations - CVE-2026-2340
Samba: vfs_worm does not block directory modification - CVE-2026-3012
Samba: group policy certificate enrollment uses http:// with
Same vendor: Red Hat
- CVE-2026-10101
Assisted-service: assisted-service: infraenv status leaks re - CVE-2026-46579
Openshift/router: openshift/router: mtls client certificate - CVE-2026-42965
Openshift/router: openshift/router: cloud metadata ssrf via - CVE-2026-10078
Quay/config-tool: quay/config-tool: gitlab oauth client_secr - CVE-2026-10052
Quay/config-tool: quay/config-tool: ssrf via unfiltered ldap
Same weakness: CWE-444
- CVE-2026-47676
Hono: app.mount() strips mount prefix using undecoded path, - CVE-2026-48710
Starlette has missing Host header validation that poisons re - CVE-2026-8620
IBM WebSphere Application Server and WebSphere Application S - CVE-2026-42585
Netty: HTTP Request Smuggling due to malformed Transfer-Enco - CVE-2026-42584
Netty: HttpClientCodec response desynchronization
V. Comments for CVE-2026-6324
No comments yet