A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled request, leading to unintended request handling.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4739-1 advisory.

    - CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after     proxy switch       (bsc#1272195).
    - CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame     protocol       violation (bsc#1271446).
    - CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory     leak       (bsc#1271448).
    - CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in     soup_multipart_input_stream_read_headers via       an oversized multipart boundary string (bsc#1271449).
    - CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT     tunnels       (bsc#1273156).
    - CVE-2026-77014: Integer truncation in sort_ranges() comparator causes silent omission of HTTP Range     responses       (bsc#1275988).
    - CVE-2026-77680: quadratic CPU denial of service in HTTP Range coalescing after the CVE-2025-32907 fix     (bsc#1276759).
    - CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).
    - CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).
    - CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).
    - CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).
    - CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).
    - CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request     smuggling       (bsc#1283831).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4690-1 advisory.

    - CVE-2026-12478: websocket: Fix out-of-bounds read when reading unmasked frame (bsc#1271401).
    - CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after     proxy switch       (bsc#1272195).
    - CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame     protocol       violation (bsc#1271446).
    - CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory     leak       (bsc#1271448).
    - CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in     soup_multipart_input_stream_read_headers via       an oversized multipart boundary string (bsc#1271449).
    - CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT     tunnels       (bsc#1273156).
    - CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).
    - CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).
    - CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).
    - CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).
    - CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request     smuggling       (bsc#1283831).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4703-1 advisory.

    - CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after     proxy switch       (bsc#1272195).
    - CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame     protocol       violation (bsc#1271446).
    - CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory     leak       (bsc#1271448).
    - CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in     soup_multipart_input_stream_read_headers via       an oversized multipart boundary string (bsc#1271449).
    - CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT     tunnels       (bsc#1273156).
    - CVE-2026-77014: Integer truncation in sort_ranges() comparator causes silent omission of HTTP Range     responses       (bsc#1275988).
    - CVE-2026-77680: quadratic CPU denial of service in HTTP Range coalescing after the CVE-2025-32907 fix     (bsc#1276759).
    - CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).
    - CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).
    - CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).
    - CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).
    - CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).
    - CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request     smuggling       (bsc#1283831).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3212 advisory.

    A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection     emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes.
    Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a     crash upon receiving a crafted Pong. (CVE-2026-102556)

    A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup     did not adequately cap total message size against the limits of the underlying buffer type. A remote peer     could send fragments that caused size truncation while the implementation still used the full length,     leading to heap corruption or a crash. (CVE-2026-102557)

    A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection     could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped,     causing a heap buffer overflow while reading frame data. (CVE-2026-102558)

    A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing     payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine     still used the full length, causing a heap buffer overflow. (CVE-2026-102559)

    A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large     outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write     past the allocated buffer and resulting in a heap buffer overflow. (CVE-2026-102560)

    A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect:
    100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body     is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive     connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated     attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled     request, leading to unintended request handling. (CVE-2026-103399)

    An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists     in the soup_multipart_input_stream_read_headers() function inside soup-multipart-input-stream.c, which     does not adequately restrict or validate the size of incoming multipart boundary strings. When processing     a crafted HTTP response containing a malformed or oversized boundary parameter, the internal stream reader     reads past the allocated buffer bounds. A remote, unauthenticated attacker can exploit this behavior to     cause a service denial (DoS) through application failure or potentially read fragments of unauthorized     memory metadata. (CVE-2026-15714)

    A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until()     function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can     exploit this by sending a crafted multipart response, potentially causing the client application to crash     or disclose sensitive heap memory. (CVE-2026-66337)

    A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for     chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign     prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this     parsing differential can be exploited to smuggle HTTP requests. (CVE-2026-66338)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libsoup installed on the remote host is prior to 2.56.0-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3998 advisory.

    A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup     did not adequately cap total message size against the limits of the underlying buffer type. A remote peer     could send fragments that caused size truncation while the implementation still used the full length,     leading to heap corruption or a crash. (CVE-2026-102557)

    A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection     could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped,     causing a heap buffer overflow while reading frame data. (CVE-2026-102558)

    A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing     payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine     still used the full length, causing a heap buffer overflow. (CVE-2026-102559)

    A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect:
    100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body     is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive     connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated     attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled     request, leading to unintended request handling. (CVE-2026-103399)

    An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists     in the soup_multipart_input_stream_read_headers() function inside soup-multipart-input-stream.c, which     does not adequately restrict or validate the size of incoming multipart boundary strings. When processing     a crafted HTTP response containing a malformed or oversized boundary parameter, the internal stream reader     reads past the allocated buffer bounds. A remote, unauthenticated attacker can exploit this behavior to     cause a service denial (DoS) through application failure or potentially read fragments of unauthorized     memory metadata. (CVE-2026-15714)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect:
    100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body
    is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive
    connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated
    attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled
    request, leading to unintended request handling. (CVE-2026-103399)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect:
    100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body     is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive     connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated     attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled     request, leading to unintended request handling. (CVE-2026-103399)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
367745	SUSE SLES15: libsoup-2_4-1 / libsoup2-devel / libsoup2-lang / etc (SUSE-SU-2026:4739-1)	Nessus	SuSE Local Security Checks	Local	critical
366750	SUSE SLES12: libsoup-2_4-1 / libsoup-2_4-1-32bit / libsoup-devel / libsoup-lang / etc (SUSE-SU-2026:4690-1)	Nessus	SuSE Local Security Checks	Local	high
366743	SUSE SLED15: libsoup-2_4-1 / libsoup2-devel / libsoup2-lang / etc (SUSE-SU-2026:4703-1)	Nessus	SuSE Local Security Checks	Local	critical
365275	Amazon Linux 2023 : libsoup, libsoup-devel (ALAS2023-2026-3212)	Nessus	Amazon Linux Local Security Checks	Local	critical
365177	Amazon Linux 2 : libsoup (ALAS-2026-3998)	Nessus	Amazon Linux Local Security Checks	Local	high
473739	Echo: libsoup3: security update to 3.6.6-1+e12	Tenable Cloud Security	Echo Local Security Checks	Local	medium
473739	Echo: libsoup3: security update to 3.6.6-1+e12	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
353361	Linux Distros Unpatched Vulnerability : CVE-2026-103399	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-103399

medium

Tenable Plugins

critical

high

critical

critical

high

medium

medium

medium