The vulnerability CVE-2026-6324 affects libsoup in Red Hat Enterprise Linux 10 and stems from an improper unsigned to signed conversion in the soup_body_input_stream_read_chunked() function. This can be exploited remotely by sending crafted HTTP requests when libsoup operates in proxy configurations involving non-libsoup components. The flaw enables HTTP request/response smuggling attacks that can bypass security controls and poison caches, potentially leading to unauthorized access. The CVSS 3.1 base score is 4.8 (medium), reflecting low complexity and limited impact on confidentiality and integrity.

Successful exploitation allows an attacker to bypass security controls, poison web caches, or gain unauthorized access. The impact is limited to confidentiality and integrity with no direct availability impact. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-6324 for current remediation guidance. No explicit remediation or workaround information is provided in the vendor advisory content available. Users should monitor the vendor advisory for updates and apply official fixes once released.