Unsigned to Signed Conversion Error in Libsoup Affects Multiple Proxy Implementations
CVE-2026-6324

4.8MEDIUM

Key Information:

Vendor: Red Hat
Status: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8
Vendor: CVE Published:; 29 May 2026

What is CVE-2026-6324?

A vulnerability exists in libsoup that arises from an error in handling unsigned to signed conversion within the soup_body_input_stream_read_chunked() function. This issue is particularly concerning when libsoup is deployed behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Attackers can exploit this flaw by sending crafted HTTP requests, potentially allowing them to bypass security mechanisms, poison web caches, or gain unauthorized access to sensitive information.