HTTP Request Smuggling Flaw in SoupServer
CVE-2026-1760

5.3MEDIUM

Key Information:

Vendor: Red Hat
Status: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8
Vendor: CVE Published:; 2 February 2026

What is CVE-2026-1760?

A flaw exists in SoupServer related to improper handling of HTTP headers, specifically Transfer-Encoding: chunked combined with Connection: keep-alive. This vulnerability enables remote, unauthenticated attackers to exploit the server by sending specially crafted requests, which can prevent the server from properly closing the connection as mandated by RFC 9112. As a result, attackers may manage to smuggle additional requests through the persistent connection, potentially causing unintended processing of those requests and leading to denial-of-service (DoS) conditions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch