The flaw lies in libsoup's chunked transfer encoding parser. The parser uses a permissive routine that accepts chunk size values which violate RFC 9112, such as leading whitespace, plus sign prefixes, or trailing invalid characters. When libsoup processes requests behind a strictly RFC‑compliant frontend proxy, this discrepancy allows an attacker to smuggle a second HTTP request into the body of the first, effectively injecting a hidden request that the downstream service will treat as a distinct request. Under the CWE‑444 classification, the vulnerability is an input‑validation error that can compromise the integrity of the application logic by enabling covert request injection.

All supported Red Hat Enterprise Linux releases from 6 through 10 contain the vulnerable libsoup component. Each of these operating systems ships the unpatched version until Red Hat issues a security update for that distro. Availability of the fix is included in the standard RHEL update channels for each version.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is less than 1%, implying a very low likelihood of exploitation at the time of assessment. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to send specially crafted requests that exploit the permissive chunk-size parsing while the traffic is routed through a proxy that enforces RFC compliance. This typically requires remote network access to the proxied server or an internal attacker with network privileges, but no local privileges or direct system access are needed.