CVE-2026-103399

Name	CVE-2026-103399
Description	A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled request, leading to unintended request handling.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libsoup2.4 (PTS)	bookworm	2.74.3-1+deb12u1	vulnerable
	trixie	2.74.3-10.1	vulnerable
libsoup3 (PTS)	bookworm	3.2.3-0+deb12u2	vulnerable
	trixie	3.6.5-3	vulnerable
	forky, sid	3.8.0-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libsoup2.4	source	(unstable)	(unfixed)
libsoup3	source	(unstable)	3.8.0-1

Notes

[trixie] - libsoup3 <no-dsa> (Minor issue)
[bookworm] - libsoup3 <ignored> (Limited support, server unsupported)
[trixie] - libsoup2.4 <no-dsa> (Minor issue)
https://bugzilla.redhat.com/show_bug.cgi?id=2543949
https://gitlab.gnome.org/GNOME/libsoup/-/work_items/539
https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/560
Fixed by: https://gitlab.gnome.org/GNOME/libsoup/-/commit/1b7fee598e0f644008028ca69d1ba74de8bc7db2 (3.8.0)