CVE-2026-3633
published 2026-03-17CVE-2026-3633: A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and…
PriorityP340medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EPSS
0.23%
13.9th percentile
A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libsoup2.4 | — | — |
| debian | libsoup3 | — | — |
| msrc | azl3_libsoup_3.4.4-12_on_azure_linux_3.0 | — | — |
| msrc | cbl2_libsoup_3.0.4-12_on_cbl_mariner_2.0 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
osv6.5MEDIUM
vendor_debian3.9LOW
vendor_msrc3.9LOW
vendor_redhat3.9LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Libsoup: libsoup: header and http request injection via crlf injection
vendor_msrc·2026-03-10·CVSS 3.9
CVE-2026-3633 [LOW] CWE-93 Libsoup: libsoup: header and http request injection via crlf injection
Libsoup: libsoup: header and http request injection via crlf injection
Mariner: Mariner
redhat: redhat
Customer Action Required: Yes
Red Hat
libsoup: libsoup: Header and HTTP request injection via CRLF injection
vendor_redhat·2026-03-06·CVSS 3.9
CVE-2026-3633 [LOW] CWE-93 libsoup: libsoup: Header and HTTP request injection via CRLF injection
libsoup: libsoup: Header and HTTP request injection via CRLF injection
A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.
A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line cons
Debian
CVE-2026-3633: libsoup2.4 - A flaw was found in libsoup. A remote attacker, by controlling the method parame...
vendor_debian·2026·CVSS 3.9
CVE-2026-3633 [LOW] CVE-2026-3633: libsoup2.4 - A flaw was found in libsoup. A remote attacker, by controlling the method parame...
A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.
Scope: local
bookworm: open
bullseye: open
trixie: open
GHSA
NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'
ghsa·2026-09-02
CVE-2026-81722 [MEDIUM] CWE-407 NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'
NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'
`nltk.stem.PorterStemmer.stem()` -- a ubiquitous public API applied to arbitrary, often untrusted, tokens -- runs in O(n^2) time on a token containing a long run of the letter 'y', letting a single ~20-50 KB token pin a CPU core (CWE-407).
## Root cause
`_is_consonant(word, i)` was made *iterative* (commit for #3633, GHSA/CWE-674) to fix an earlier unbounded-recursion `RecursionError` on `'y'*10000`. The iterative form walks *backward* over the whole run of 'y's on every call:
```python
while i > 0 and word[i] == 'y':
negate = not negate
i -= 1
```
`_measure()` then calls `_is_consonant(stem, i)` once for **every** position `i` of the stem. For a run of n 'y's that is sum_{i} O(i) = O(n^2). The recursion fix therefore trad
OSV
CVE-2026-3633: A flaw was found in libsoup
osv·2026-03-17·CVSS 6.5
CVE-2026-3633 [MEDIUM] CVE-2026-3633: A flaw was found in libsoup
A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.
GHSA
GHSA-6p72-283f-crv2: A flaw was found in libsoup
ghsa_unreviewed·2026-03-17
CVE-2026-3633 [LOW] CWE-93 GHSA-6p72-283f-crv2: A flaw was found in libsoup
A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-3633 libsoup: libsoup: Header and HTTP request injection via CRLF injection
bugzilla·2026-03-06·CVSS 6.5
CVE-2026-3633 [MEDIUM] CVE-2026-3633 libsoup: libsoup: Header and HTTP request injection via CRLF injection
CVE-2026-3633 libsoup: libsoup: Header and HTTP request injection via CRLF injection
The soup_message_new() function is used to create a new empty request, which will connect to the provided URI. The request line is constructed using the g_string_append_printf() function without escaping the method value:
g_string_append_printf (header, "%s %s HTTP/1.%d\r\n",
soup_message_get_method (msg), uri_string,
(soup_message_get_http_version (msg) == SOUP_HTTP_1_0) ? 0 : 1);
If the method parameter of soup_message_new() is user-controlled, a malicious user could inject arbitrary headers and further request data using CRLF sequences.
A simple example demonstrating the issue is given in the attachment. Running this code confirms that the server on localhost:5000 receives a valid HTTP request conta
Bugzilla
CVE-2026-3632 CVE-2026-3633 CVE-2026-3634 libsoup: various flaws [fedora-all]
bugzilla·2026-03-06·CVSS 5.5
CVE-2026-3632 [MEDIUM] CVE-2026-3632 CVE-2026-3633 CVE-2026-3634 libsoup: various flaws [fedora-all]
CVE-2026-3632 CVE-2026-3633 CVE-2026-3634 libsoup: various flaws [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.
Bugzilla
CVE-2026-3632 CVE-2026-3633 CVE-2026-3634 libsoup3: various flaws [fedora-all]
bugzilla·2026-03-06·CVSS 5.5
CVE-2026-3632 [MEDIUM] CVE-2026-3632 CVE-2026-3633 CVE-2026-3634 libsoup3: various flaws [fedora-all]
CVE-2026-3632 CVE-2026-3633 CVE-2026-3634 libsoup3: various flaws [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.
Bugzilla
CVE-2026-3632 CVE-2026-3633 CVE-2026-3634 mingw-libsoup: various flaws [fedora-all]
bugzilla·2026-03-06·CVSS 5.5
CVE-2026-3632 [MEDIUM] CVE-2026-3632 CVE-2026-3633 CVE-2026-3634 mingw-libsoup: various flaws [fedora-all]
CVE-2026-3632 CVE-2026-3633 CVE-2026-3634 mingw-libsoup: various flaws [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Wiz
CVE-2026-3633 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2026-3633 [MEDIUM] CVE-2026-3633 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-3633 :
Linux Debian vulnerability analysis and mitigation
soup_message_new()
Source : NVD
## 6.5
Score
Published March 17, 2026
Severity MEDIUM
CNA Score 3.9
Affected Technologies
Linux Debian
Linux Ubuntu
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 9.8
Exploitation Probability (EPSS) N/A
Affected packages and libraries
libsoup
libsoup3-devel
Sources
NVD
Debian 11, 12, 13, 14 Severity MEDIUM No Fix Added at: Mar 09, 2026
Echo Severity MEDIUM No Fix Added at: Mar 09, 2026
Red Hat 6, 7, 8, 9, 10 Severity LOW No Fix Added at: Mar 08, 2026
Red Hat 7 Severity MEDIUM Has Fix Added at: Mar 08, 2026
Ubuntu 16.04, 18.04, 20.04, 22.04, 24.04, 25.10 Severity MEDIUM No
2026-03-17
Published