CVE-2026-3633: gnome libsoup CRLF Injection

Vulnerability summary

CVE-2026-3633 is a medium (CVSS 6.5) CRLF Injection vulnerability in gnome libsoup. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 17-03-2026
   PublishedVulnerability first disclosed.
2. 19-03-2026
   Last modifiedVulnerability information updated.

Description

A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.

• CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.