This flaw resides in the libsoup networking library used by applications to send HTTP requests. Because the library fails to validate hostnames, attackers can embed special characters in the Host header. The injected characters allow HTTP request smuggling, where one request is hidden within another. In some configurations, the injection can also trigger Server‑Side Request Forgery, forcing the server to issue requests to internal or external endpoints that the attacker controls. Although the root cause is low severity, the consequence is that a remote attacker could make the target server fetch or interact with unintended resources, potentially exposing sensitive data or triggering downstream vulnerabilities.

Red Hat Enterprise Linux distributions 6, 7, 8, 9 and 10 are listed as affected. The vulnerability also applies to the GNOME libsoup library, which is part of the infrastructure of these operating systems. Specific vulnerable package versions are not enumerated in the advisory, so all current installations of libsoup on these RHEL releases should be considered at risk pending further detail.

The CVSS score of 3.9 indicates low severity, and the EPSS score is under 1 percent, suggesting a small likelihood of exploitation as of the data snapshot. The vulnerability is not present in CISA’s KEV catalog. The likely attack vector is remote network‑based, where an attacker sends a crafted HTTP request to an application using libsoup. If the application runs with elevated privileges or communicates with internal services, the attacker could use the SSRF capability to access those resources. While the vulnerability alone does not grant arbitrary code execution, its misuse could provide a foothold for further lateral movement or data exfiltration.