Vulnerability Description
A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gnome | Libsoup | - |
| Redhat | Enterprise Linux | 6.0 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/security/cve/CVE-2026-3633Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2445128Issue TrackingVendor Advisory
- https://gitlab.gnome.org/GNOME/libsoup/-/issues/484ExploitIssue TrackingVendor Advisory
FAQ
What is CVE-2026-3633?
CVE-2026-3633 is a vulnerability with a CVSS score of 3.9 (LOW). A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability...
How severe is CVE-2026-3633?
CVE-2026-3633 has been rated LOW with a CVSS base score of 3.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-3633?
Check the references section above for vendor advisories and patch information. Affected products include: Gnome Libsoup, Redhat Enterprise Linux.