CVE-2026-3633

Published: Mar 17, 2026Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 3.9 / Impact: 2.5

Source: NVD

Description

A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.

Affected (6)

Products: Gnome: Libsoup · Redhat: Enterprise Linux

1 product

1 product

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Gnome Libsoup	All versions
Redhat Enterprise Linux	Version 10.0
Redhat Enterprise Linux	Version 6.0
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux	Version 9.0

Related CWEs

CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

References (3)

https://access.redhat.com/security/cve/CVE-2026-3633

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2445128

Source: secalert@redhat.com

Issue TrackingVendor Advisory

https://gitlab.gnome.org/GNOME/libsoup/-/issues/484

Source: secalert@redhat.com

ExploitIssue TrackingVendor Advisory

Timeline

No history available yet.