A critical HTTP request smuggling vulnerability in the libsoup library allows unauthenticated attackers to bypass host-based security controls and perform cache poisoning.

This vulnerability occurs due to the inconsistent interpretation of HTTP requests when multiple Host headers are provided. An unauthenticated attacker can supply conflicting headers to cause a mismatch between front-end proxies and back-end services, enabling request smuggling or unauthorized access to restricted virtual hosts.

The ability to manipulate HTTP routing poses a significant risk to organizational infrastructure, as it may allow attackers to bypass perimeter security controls or poison web caches. With a CVSS score of 8.2, this vulnerability is classified as High severity because it facilitates unauthorized access and potential data manipulation without requiring prior authentication. Successful exploitation could lead to sensitive information disclosure or the subversion of business-critical web applications.

Immediate Action: Apply the relevant security updates provided by Red Hat in the referenced errata (RHSA-2026:0421 through RHSA-2026:0906) to ensure the libsoup library is patched to the specified secure versions.

Proactive Monitoring: Monitor web server access logs for anomalous request patterns, specifically looking for requests containing duplicate or malformed Host headers.

Compensating Controls: Deploy or tune Web Application Firewall (WAF) rules to inspect incoming HTTP requests for multiple Host headers and block or sanitize requests that violate RFC specifications.

Public Exploit Available: Unknown.

Given the potential for request smuggling and the high CVSS score, organizations should prioritize patching affected Red Hat systems as part of their next maintenance cycle. System administrators should verify that all instances of libsoup are updated to the versions specified in the provided vendor errata to eliminate the risk of host-based access control bypasses.