The libsoup library, used as an HTTP client and server library in GNOME, is vulnerable to HTTP request smuggling due to the stripping of null bytes from the ends of header names (CVE-2024-52530). This vulnerability can allow an attacker to manipulate HTTP requests in a way that bypasses security controls or causes unintended behavior. Red Hat has released an update for Red Hat Enterprise Linux 8.4 to address this issue, as detailed in advisory RHSA-2024:9566. The update fixes the vulnerability by correcting the handling of null bytes in HTTP header names. The advisory rates the security impact as Important, and no CVSS score is provided. There are no known exploits in the wild at this time.

The vulnerability enables HTTP request smuggling via improper handling of null bytes in HTTP header names, potentially allowing attackers to interfere with HTTP request processing. This can lead to security bypasses or other unintended behaviors in applications relying on libsoup. The exact impact depends on the deployment context but is considered significant enough to warrant an important security rating by Red Hat. No known active exploitation has been reported.

Red Hat has released an official security update for libsoup in Red Hat Enterprise Linux 8.4 variants to fix this vulnerability. Users should apply the update as described in Red Hat advisory RHSA-2024:9566 and the referenced article https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the vulnerability. No additional mitigation steps are indicated by the vendor.