HTTP Request Smuggling Flaw in SoupServer
CVE-2026-1760

5.3MEDIUM

Key Information:

Vendor: Red Hat
Status: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8
Vendor: CVE Published:; 2 February 2026

What is CVE-2026-1760?

A flaw exists in SoupServer related to improper handling of HTTP headers, specifically Transfer-Encoding: chunked combined with Connection: keep-alive. This vulnerability enables remote, unauthenticated attackers to exploit the server by sending specially crafted requests, which can prevent the server from properly closing the connection as mandated by RFC 9112. As a result, attackers may manage to smuggle additional requests through the persistent connection, potentially causing unintended processing of those requests and leading to denial-of-service (DoS) conditions.