Libsoup: libsoup: header and http request injection via crlf injection
Published Mar 17, 2026
6.5
MEDIUMCVSS 3.1
EPSS 0.37%
Description
A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.
Affected products
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||
|---|---|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | affected |
| |||
| Red Hat | Red Hat Enterprise Linux 7 | affected |
| |||
| Red Hat | Red Hat Enterprise Linux 8 | affected |
| |||
| Red Hat | Red Hat Enterprise Linux 9 | affected |
|
- n/a
- 6.0
- 7.0
- 8.0
- 9.0
- 10.0
No data.
Red Hat Enterprise Linux 10
libsoup3
Fix deferred
Red Hat Enterprise Linux 6
libsoup
Out of support scope
Red Hat Enterprise Linux 7
libsoup
Fix deferred
Red Hat Enterprise Linux 8
libsoup
Fix deferred
Red Hat Enterprise Linux 9
libsoup
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | libsoup3 | Fix deferred | n/a |
| Red Hat Enterprise Linux 6 | libsoup | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | libsoup | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | libsoup | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | libsoup | Fix deferred | n/a |
No package ranges for this CVE.
Remediation
Vendor solution
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Red Hat statement
This is a LOW impact flaw in libsoup. An attacker could inject arbitrary HTTP headers and request data if an application using libsoup passes unsanitized, user-controlled input to the `soup_message_new()` function's method parameter.
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
References (6)
- https://access.redhat.com/security/cve/CVE-2026-3633 vdb-entryx_refsource_REDHATVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2445128 issue-trackingx_refsource_REDHATIssue TrackingVendor Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12560 Advisory
- https://gitlab.gnome.org/GNOME/libsoup/-/issues/484 ExploitIssue TrackingVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-3633
- https://www.cve.org/CVERecord?id=CVE-2026-3633
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-3633 | vdb-entryx_refsource_REDHATVendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2445128 | issue-trackingx_refsource_REDHATIssue TrackingVendor Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12560 | Advisory | |
| https://gitlab.gnome.org/GNOME/libsoup/-/issues/484 | ExploitIssue TrackingVendor Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2026-3633 | ||
| https://www.cve.org/CVERecord?id=CVE-2026-3633 |
Change history (0)
No recorded changes yet.