Read the docs
TI-2024-35200 Aliases CVE-2024-52530GHSA-37r8-854r-595c

GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because…

Priority MEDIUM 40CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 23 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is treated the same as a "Transfer-Encoding: chunked" header.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00783 56th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 10 advisoriesRed Hat: 23 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gnome:libsoup:*:*:*:*:*:*:*:*before 3.6.0VulnerableGNOME
  • cpe:2.3:a:gnome:libsoup:*:*:*:*:*:*:*:* Versions before 3.6.0 Vulnerable ·GNOME

Remediation

Red Hat 10 advisories

  • RHSA-2024:9654 Released 2024-11-14 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) libsoup-2.62.2-3.el7_9, libsoup-2.62.2-3.el7_9.ppc, libsoup-devel-2.62.2-3.el7_9 +1
  • RHSA-2024:9573 Released 2024-11-13 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream (v. 8) libsoup-devel-2.62.3-6.el8_10
    • Red Hat Enterprise Linux BaseOS (v. 8) libsoup-2.62.3-6.el8_10
  • RHSA-2024:9576 Released 2024-11-13 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) libsoup-2.72.0-8.el9_0.1, libsoup-devel-2.72.0-8.el9_0.1
Show 7 more Red Hat advisories
  • RHSA-2024:9572 Released 2024-11-13 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) libsoup-2.72.0-8.el9_4.1, libsoup-devel-2.72.0-8.el9_4.1
  • RHSA-2024:9570 Released 2024-11-13 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) libsoup-2.72.0-8.el9_2.1, libsoup-devel-2.72.0-8.el9_2.1
  • RHSA-2024:9566 Released 2024-11-13 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) libsoup-devel-2.62.3-2.el8_4.1
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) libsoup-devel-2.62.3-2.el8_4.1
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) libsoup-devel-2.62.3-2.el8_4.1
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) libsoup-2.62.3-2.el8_4.1
    • Red Hat Enterprise Linux BaseOS E4S (v.8.4) libsoup-2.62.3-2.el8_4.1
    • Red Hat Enterprise Linux BaseOS TUS (v.8.4) libsoup-2.62.3-2.el8_4.1
  • RHSA-2024:9559 Released 2024-11-13 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream (v. 9) libsoup-2.72.0-8.el9_5.2, libsoup-devel-2.72.0-8.el9_5.2
  • RHSA-2024:9525 Released 2024-11-13 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) libsoup-devel-2.62.3-2.el8_6.1
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) libsoup-devel-2.62.3-2.el8_6.1
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) libsoup-devel-2.62.3-2.el8_6.1
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) libsoup-2.62.3-2.el8_6.1
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) libsoup-2.62.3-2.el8_6.1
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) libsoup-2.62.3-2.el8_6.1
  • RHSA-2024:9524 Released 2024-11-13 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) libsoup-devel-2.62.3-3.el8_8.1
    • Red Hat Enterprise Linux BaseOS EUS (v.8.8) libsoup-2.62.3-3.el8_8.1
  • RHSA-2024:9501 Released 2024-11-13 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) libsoup-devel-2.62.3-1.el8_2.1
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) libsoup-2.62.3-1.el8_2.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:9573
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:9559
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2024:9501
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2024:9566
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2024:9525
Red Hat Enterprise Linux AppStream E4S (v.8.4)Fixed RHSA-2024:9566
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2024:9525
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2024:9576
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2024:9524
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:9570
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2024:9572
Red Hat Enterprise Linux AppStream TUS (v.8.4)Fixed RHSA-2024:9566
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2024:9525
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2024:9573
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2024:9501
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2024:9566
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2024:9525
Red Hat Enterprise Linux BaseOS E4S (v.8.4)Fixed RHSA-2024:9566
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2024:9525
Red Hat Enterprise Linux BaseOS EUS (v.8.8)Fixed RHSA-2024:9524
Red Hat Enterprise Linux BaseOS TUS (v.8.4)Fixed RHSA-2024:9566
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2024:9525
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2024:9654
Not affected: 1 product
  • Red Hat Enterprise Linux 10

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-52530
  2. 2026-10-03 Alias added: GHSA-37r8-854r-595c

References

Exploit 1

Advisory 1

Other 1

  • TI-2026-03716 Libsoup: libsoup: denial of service via use-after-free in http/2 server CVSS 3.1HIGH 7.5
  • TI-2024-35201 Out-of-bounds write in GNOME libsoup CVSS 3.1HIGH 8.4
  • TI-2025-02434 Libsoup: heap buffer over-read in `skip_insignificant_space` when sniffing content CVSS 3.1HIGH 7.0
  • TI-2026-03134 Libsoup: libsoup: http header injection and response splitting via crlf injection in content-type header CVSS 3.1MEDIUM 6.5
  • TI-2017-02105 Out-of-bounds write in GNOME libsoup CVSS 3.1CRITICAL 9.8
  • TI-2026-10764 Libsoup: heap out-of-bounds read in libsoup due to integer truncation CVSS 3.1MEDIUM 4.2
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences