CVE-2026-103399 Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body

Description

A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled request, leading to unintended request handling.

Exploitable remotely over the network, without an account and without any user action; the impact on data or service is limited.

Attack vector

Network

Attack complexity

Low

Privileges required

None

Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected products and versions