CVE-2026-3633: Libsoup: libsoup: header and http request injection via crlf injection
A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the soupmessagenew() function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.
Other sources
The soupmessagenew() function is used to create a new empty request, which will connect to the provided URI. The request line is constructed using the gstringappendprintf() function without escaping the method value:
gstringappendprintf (header, "%s %s HTTP/1.%d\r\n", soupmessagegetmethod (msg), uristring, (soupmessagegethttpversion (msg) == SOUPHTTP10) ? 0 : 1);
If the method parameter of soupmessagenew() is user-controlled, a malicious user could inject arbitrary headers and further request data using CRLF sequences. A simple example demonstrating the issue is given in the attachment. Running this code confirms that the server on localhost:5000 receives a valid HTTP request containing the injected X-Injected-By header with the value injection. CRLFinjinmethod.c
Impact An attacker controlling the value used to set the method is able to perform a CRLF injection, potentially leading to header injection and HTTP request injection.
Recommended solution Provided methods containing invalid characters should be refused or sanitized. Sanitize or refuse provided methods which contain invalid characters, including any form of whitespace.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3633?
CVE-2026-3633 is considered a high-severity vulnerability due to its potential for remote header and HTTP request injection.
How do I fix CVE-2026-3633?
To fix CVE-2026-3633, update libsoup to the latest version that addresses this vulnerability.
Who is affected by CVE-2026-3633?
CVE-2026-3633 affects users of libsoup, particularly versions included in Red Hat Enterprise Linux 6.0 through 10.0.
What types of attacks can CVE-2026-3633 enable?
CVE-2026-3633 can enable remote attackers to inject arbitrary headers and additional data into HTTP requests.
What is the root cause of CVE-2026-3633?
The root cause of CVE-2026-3633 is a flaw in the `soup_message_new()` function's handling of the method parameter.