VULNERABILITY INTELLIGENCE

CVE-2026-3633

CVSS score3.9 LOW
EPSS probability0.23%
CISA KEVNot currently listed
Published2026-03-17
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

Description

A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.

Weakness classification

  • CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')

Primary references