ZeroDay Findings
Sign inSign up

Findings

CVE-2026-3633

A flaw was found in libsoup.

Published Mar 17, 2026 · updated Jun 17, 2026 · gnome libsoup

A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 17, 2026 · NIST NVD

    Detected

    A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.

  2. Jun 17, 2026 · NIST NVD

    Updated

    A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.

Affected

  • cpe gnome/libsoupversion unspecified
  • cpe redhat/enterprise linux10.0
  • cpe redhat/enterprise linux6.0
  • cpe redhat/enterprise linux7.0
  • cpe redhat/enterprise linux8.0
  • cpe redhat/enterprise linux9.0

Sources

  • CVE.orgVulnerability recordCVE-2026-3633

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-3633

    A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method

    nvd.nist.gov

References