CVE-2026-3633
published 2026-03-17CVE-2026-3633: A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and…
PriorityP340medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EPSS
0.22%
12.9th percentile
A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libsoup2.4 | — | — |
| debian | libsoup3 | — | — |
| msrc | azl3_libsoup_3.4.4-12_on_azure_linux_3.0 | — | — |
| msrc | cbl2_libsoup_3.0.4-12_on_cbl_mariner_2.0 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
osv6.5MEDIUM
vendor_debian3.9LOW
vendor_msrc3.9LOW
vendor_redhat3.9LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Libsoup: libsoup: header and http request injection via crlf injection
vendor_msrc·2026-03-10·CVSS 3.9
CVE-2026-3633 [LOW] CWE-93 Libsoup: libsoup: header and http request injection via crlf injection
Libsoup: libsoup: header and http request injection via crlf injection
Mariner: Mariner
redhat: redhat
Customer Action Required: Yes
Red Hat
libsoup: libsoup: Header and HTTP request injection via CRLF injection
vendor_redhat·2026-03-06·CVSS 3.9
CVE-2026-3633 [LOW] CWE-93 libsoup: libsoup: Header and HTTP request injection via CRLF injection
libsoup: libsoup: Header and HTTP request injection via CRLF injection
A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.
A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line cons
Debian
CVE-2026-3633: libsoup2.4 - A flaw was found in libsoup. A remote attacker, by controlling the method parame...
vendor_debian·2026·CVSS 3.9
CVE-2026-3633 [LOW] CVE-2026-3633: libsoup2.4 - A flaw was found in libsoup. A remote attacker, by controlling the method parame...
A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.
Scope: local
bookworm: open
bullseye: open
trixie: open
OSV
CVE-2026-3633: A flaw was found in libsoup
osv·2026-03-17·CVSS 6.5
CVE-2026-3633 [MEDIUM] CVE-2026-3633: A flaw was found in libsoup
A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.
GHSA
GHSA-6p72-283f-crv2: A flaw was found in libsoup
ghsa_unreviewed·2026-03-17
CVE-2026-3633 [LOW] CWE-93 GHSA-6p72-283f-crv2: A flaw was found in libsoup
A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-3633 libsoup: libsoup: Header and HTTP request injection via CRLF injection
bugzilla·2026-03-06·CVSS 6.5
CVE-2026-3633 [MEDIUM] CVE-2026-3633 libsoup: libsoup: Header and HTTP request injection via CRLF injection
CVE-2026-3633 libsoup: libsoup: Header and HTTP request injection via CRLF injection
The soup_message_new() function is used to create a new empty request, which will connect to the provided URI. The request line is constructed using the g_string_append_printf() function without escaping the method value:
g_string_append_printf (header, "%s %s HTTP/1.%d\r\n",
soup_message_get_method (msg), uri_string,
(soup_message_get_http_version (msg) == SOUP_HTTP_1_0) ? 0 : 1);
If the method parameter of soup_message_new() is user-controlled, a malicious user could inject arbitrary headers and further request data using CRLF sequences.
A simple example demonstrating the issue is given in the attachment. Running this code confirms that the server on localhost:5000 receives a valid HTTP request conta
Wiz
CVE-2026-3633 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2026-3633 [MEDIUM] CVE-2026-3633 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-3633 :
Linux Debian vulnerability analysis and mitigation
soup_message_new()
Source : NVD
## 6.5
Score
Published March 17, 2026
Severity MEDIUM
CNA Score 3.9
Affected Technologies
Linux Debian
Linux Ubuntu
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 9.8
Exploitation Probability (EPSS) N/A
Affected packages and libraries
libsoup
libsoup3-devel
Sources
NVD
Debian 11, 12, 13, 14 Severity MEDIUM No Fix Added at: Mar 09, 2026
Echo Severity MEDIUM No Fix Added at: Mar 09, 2026
Red Hat 6, 7, 8, 9, 10 Severity LOW No Fix Added at: Mar 08, 2026
Red Hat 7 Severity MEDIUM Has Fix Added at: Mar 08, 2026
Ubuntu 16.04, 18.04, 20.04, 22.04, 24.04, 25.10 Severity MEDIUM No
2026-03-17
Published