CVE-2026-1467 — CRLF Injection in Redhat Enterprise Linux

CWE-93 — CRLF Injection9 documents8 sources
Severity
5.3MEDIUMNVD
CNA5.8
EPSS
0.1%
top 81.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Redhat Enterprise Linux
Timeline
PublishedJan 27
Latest updateFeb 8

Description

A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF (Carriage Return Line Feed) Injection, occurs when an HTTP proxy is configured and the library improperly handles URL-decoded input used to create the Host header. A remote attacker can exploit this by providing a specially crafted URL containing CRLF sequences, allowing them to inject additional HTTP headers or complete HTTP request bodies. This can lead to unintended or unauthorized HTTP requests being forwa…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages0 packages

Also affects: Enterprise Linux 10.0, 6.0, 7.0, 8.0, 9.0

🔴Vulnerability Details

4
OSV
libsoup3 vulnerabilities↗2026-02-08
▶
CVEList
Libsoup: libsoup: http header injection via specially crafted urls when an http proxy is configured↗2026-01-27
▶
GHSA
GHSA-8pm5-xr39-vfv3: A flaw was found in libsoup, an HTTP client library↗2026-01-27
▶
OSV
CVE-2026-1467: A flaw was found in libsoup, an HTTP client library↗2026-01-27
▶

📋Vendor Advisories

3
Ubuntu
libsoup vulnerabilities↗2026-02-08
▶
Red Hat
libsoup: libsoup: HTTP header injection via specially crafted URLs when an HTTP proxy is configured↗2026-01-27
▶
Debian
CVE-2026-1467: libsoup2.4 - A flaw was found in libsoup, an HTTP client library. This vulnerability, known a...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-1467 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-1467 — CRLF Injection in Redhat | cvebase