libsoup includes an embedded HTTP/1 server. When a server sits behind a proxy / load balancer, it’s critical that every hop agrees on how request bodies are framed.
In the affected code path, libsoup accepted HTTP/1 requests with ambiguous body framing:

multiple Content-Length headers (CL.CL)

Transfer-Encoding: chunked together with Content-Length (TE+CL)

Different intermediaries pick different framing rules in these cases. If a front-end and back-end disagree, an attacker can desynchronize the connection and “smuggle” an extra request through the chain. Depending on deployment, this can lead to routing/ACL bypass, cache poisoning, or reaching internal-only endpoints.