HTTP request smuggling vulnerability in SoupServer due to improper handling of requests containing Transfer-Encoding: chunked combined with Connection: keep-alive. Although SoupServer correctly ignores the Content-Length header, it fails to close the connection after responding, in violation of RFC 9112. This allows remaining chunked data to be processed as a subsequent HTTP request. A remote, unauthenticated client can exploit this behavior to smuggle additional requests over a persistent connection, leading to unintended request processing and potential denial-of-service conditions.