The libsoup library contains a flaw in its chunked transfer encoding parser where it uses a permissive parsing function for chunk sizes. This function silently accepts inputs that violate RFC 9112 specifications, such as leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, the difference in parsing behavior can be exploited to smuggle HTTP requests, potentially bypassing security controls.

This vulnerability can lead to HTTP request smuggling attacks in environments where libsoup is deployed behind strict frontend proxies. The impact includes limited confidentiality and integrity loss but no availability impact, as indicated by the CVSS vector. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor the Red Hat advisory and other vendor communications for updates on remediation. Until a fix is available, consider reviewing proxy configurations and monitoring for anomalous HTTP traffic patterns related to chunked transfer encoding.