CRLF Injection Vulnerability in Libsoup Affects GNOME Products
CVE-2026-3633

3.9LOW

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
17 March 2026

What is CVE-2026-3633?

A security flaw in Libsoup allows remote attackers to exploit an improperly validated method parameter in the soup_message_new() function. This vulnerability facilitates CRLF (Carriage Return Line Feed) injection, enabling attackers to craft malicious headers and additional request data. If successfully exploited, this could lead to significant security risks such as HTTP request injection, potentially compromising the integrity of the application and the data it processes.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://access.redhat.com/security/cve/CVE-2026-3633
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2445128
issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/libsoup/-/issues/484

CVSS V3.1

Score:
3.9
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Codean Labs for reporting this issue.
JSON
.