CVE-2026-1536: Libsoup: libsoup: http header injection or response splitting via crlf injection in content-disposition header
A flaw was found in libsoup. An attacker who can control the input for the Content-Disposition header can inject CRLF (Carriage Return Line Feed) sequences into the header value. These sequences are then interpreted verbatim when the HTTP request or response is constructed, allowing arbitrary HTTP headers to be injected. This vulnerability can lead to HTTP header injection or HTTP response splitting without requiring authentication or user interaction.
Other sources
CRLF injection vulnerability in the soupmessageheaderssetcontentdisposition() function of the libsoup HTTP library. The issue occurs because this function internally uses soupmessageheadersappendcommon(), which does not enforce character restrictions on header values. As a result, an attacker who can control the input used for the Content-Disposition header can inject CRLF sequences into the header value. When the HTTP request or response is later constructed, these sequences are interpreted verbatim, allowing arbitrary HTTP headers to be injected. This can lead to header injection or HTTP response splitting without authentication or user interaction.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1536?
CVE-2026-1536 is considered a high severity vulnerability due to its potential for HTTP header injection and response splitting.
How do I fix CVE-2026-1536?
To fix CVE-2026-1536, update libsoup to the latest version that addresses this vulnerability.
What does CVE-2026-1536 exploit?
CVE-2026-1536 exploits a flaw in the Content-Disposition header where an attacker can inject CRLF sequences.
Who is affected by CVE-2026-1536?
CVE-2026-1536 affects systems using the libsoup library that allow user-controlled input for the Content-Disposition header.
What can an attacker achieve with CVE-2026-1536?
An attacker can execute HTTP response splitting attacks leading to various impacts, possibly including session hijacking.