VulnerabilityAnalyzed
CVE-2026-3633
A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data.
MEDIUM 6.5EPSS 0.22%
Does this matter?
Lower severity and a low EPSS score (0.22%). Track it; it rarely justifies an emergency change on its own.
Description
A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- EPSS
- 0.22% probability · 13th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-93
- Affected
- gnome/libsoup · redhat/enterprise linux
- Source
- secalert@redhat.com
References
- https://access.redhat.com/security/cve/CVE-2026-3633Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2445128Issue Tracking, Vendor Advisory
- https://gitlab.gnome.org/GNOME/libsoup/-/issues/484Exploit, Issue Tracking, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.