{
  "document": {
    "aggregate_severity": {
      "text": "Medium"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/cloudlinux7els/vex/2026/cve-2026-2708-els_os-cloudlinux7els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-10-23T22:30:07Z",
      "generator": {
        "date": "2026-10-23T22:30:07Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2026-2708-ELS_OS-CLOUDLINUX7ELS",
      "initial_release_date": "2026-04-23T22:16:00Z",
      "revision_history": [
        {
          "date": "2026-04-23T22:16:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-23T22:30:07Z",
          "number": "2",
          "summary": "Official Publication"
        }
      ],
      "status": "final",
      "version": "2"
    },
    "title": "Security update on CVE-2026-2708"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "CloudLinux 7",
                "product": {
                  "name": "CloudLinux 7",
                  "product_id": "CloudLinux-7",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:cloudlinux:cloudlinux:7:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "CloudLinux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsoup-devel-0:2.62.2-2.0.13.el7.i686",
                "product": {
                  "name": "libsoup-devel-0:2.62.2-2.0.13.el7.i686",
                  "product_id": "libsoup-devel-0:2.62.2-2.0.13.el7.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libsoup-devel@2.62.2-2.0.13.el7?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-0:2.62.2-2.0.13.el7.i686",
                "product": {
                  "name": "libsoup-0:2.62.2-2.0.13.el7.i686",
                  "product_id": "libsoup-0:2.62.2-2.0.13.el7.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libsoup@2.62.2-2.0.13.el7?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsoup-devel-0:2.62.2-2.0.13.el7.x86_64",
                "product": {
                  "name": "libsoup-devel-0:2.62.2-2.0.13.el7.x86_64",
                  "product_id": "libsoup-devel-0:2.62.2-2.0.13.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libsoup-devel@2.62.2-2.0.13.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-0:2.62.2-2.0.13.el7.x86_64",
                "product": {
                  "name": "libsoup-0:2.62.2-2.0.13.el7.x86_64",
                  "product_id": "libsoup-0:2.62.2-2.0.13.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libsoup@2.62.2-2.0.13.el7?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Cloud Linux Software, Inc."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
                "product": {
                  "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
                  "product_id": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libsoup-devel@2.62.2-2.0.13.el7.tuxcare.els2?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
                "product": {
                  "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
                  "product_id": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libsoup@2.62.2-2.0.13.el7.tuxcare.els2?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
                "product": {
                  "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
                  "product_id": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libsoup-devel@2.62.2-2.0.13.el7.tuxcare.els2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
                "product": {
                  "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
                  "product_id": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libsoup@2.62.2-2.0.13.el7.tuxcare.els2?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "CloudLinux"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686"
        },
        "product_reference": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-devel-0:2.62.2-2.0.13.el7.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.i686"
        },
        "product_reference": "libsoup-devel-0:2.62.2-2.0.13.el7.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64"
        },
        "product_reference": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-devel-0:2.62.2-2.0.13.el7.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.x86_64"
        },
        "product_reference": "libsoup-devel-0:2.62.2-2.0.13.el7.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686"
        },
        "product_reference": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-0:2.62.2-2.0.13.el7.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.i686"
        },
        "product_reference": "libsoup-0:2.62.2-2.0.13.el7.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64"
        },
        "product_reference": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-0:2.62.2-2.0.13.el7.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.x86_64"
        },
        "product_reference": "libsoup-0:2.62.2-2.0.13.el7.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-2708",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"
      },
      "notes": [
        {
          "category": "description",
          "text": "A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.",
          "title": "Vulnerability description"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.i686",
          "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
          "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
          "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.x86_64",
          "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.i686",
          "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
          "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
          "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-2708"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/security/cve/CVE-2026-2708",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2708"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2440743",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440743"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/500",
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/500"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/513",
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/513"
        }
      ],
      "release_date": "2026-04-23T22:16:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "date": "2026-10-15T15:18:35.042106Z",
          "details": "This flaw is only exploitable when a libsoup-based component is exposed as an HTTP/1 server and sits in a multi-hop chain with a proxy/load balancer that parses message framing differently; single-hop services or libsoup used purely as an HTTP client are not affected. It provides no confidentiality or availability impact and only limited request desynchronization (low integrity), and current assessments characterize exploitation as high complexity in practice. Given these constraints, it is reasonable to deprioritize in centrally managed enterprise VM/server environments that do not rely on libsoup as the public-facing HTTP/1 stack.",
          "product_ids": [
            "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.i686",
            "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
            "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
            "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.x86_64",
            "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.i686",
            "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
            "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
            "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.i686",
            "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
            "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
            "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.x86_64",
            "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.i686",
            "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
            "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
            "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    }
  ]
}