The vulnerability in libsoup's chunked transfer encoding parser allows inconsistent interpretation of HTTP requests due to acceptance of non-compliant chunk size formats. This parsing difference between libsoup and strict frontend proxies can be leveraged to smuggle HTTP requests, potentially leading to request desynchronization attacks. The flaw specifically involves permissive parsing of chunk sizes that violate RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters.

Successful exploitation of this vulnerability can lead to HTTP request smuggling attacks, which may allow an attacker to bypass security controls, interfere with request routing, or cause other unintended behaviors in proxied HTTP communications. The CVSS score of 5.4 reflects a medium impact with limited confidentiality and integrity loss and no availability impact.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-66338 for current remediation guidance. Until an official fix is available, users should consider network-level mitigations such as reviewing proxy configurations to detect or block malformed chunked requests. No vendor advisory states that no action is required or that the issue is already mitigated.