CVE-2026-2708 is a vulnerability in the libsoup library component of Red Hat Enterprise Linux 10, where the soup_message_headers_append_common() function improperly handles HTTP headers by appending them without checking for duplicate or conflicting Content-Length headers. This flaw enables an attacker to craft HTTP requests containing multiple Content-Length headers with differing values, leading to inconsistent interpretation of HTTP requests, a condition known as HTTP request smuggling. The vulnerability is rated low severity with a CVSS score of 3.7, primarily affecting data integrity but not confidentiality or availability. There is no vendor advisory confirming patch availability or mitigation status at this time, and no known exploitation in the wild has been reported.

The vulnerability may allow limited integrity issues due to inconsistent interpretation of HTTP requests caused by multiple conflicting Content-Length headers. It does not impact confidentiality or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-2708 for current remediation guidance. No explicit vendor advisory statement about patch availability or mitigation is provided in the available information.