CVE-2026-3634: Libsoup: libsoup: http header injection and response splitting via crlf injection in content-type header

The soupmessageheaderssetcontenttype() function sets the Content-Type header value. Internally, it calls soupmessageheadersappendcommon() to add the new Content-Type value to an accumulating array. Unlike soupmessageheadersappend(), the internal soupmessageheadersappendcommon() function does not enforce any restrictions on the allowed characters in the header value, allowing the creation of a header whose value contains a CRLF sequence. Later, when the HTTP request or response is constructed, the header strings are interpreted without further sanitization, resulting in the effective injection of a CRLF sequence, and hence, arbitrary header-value pairs. A proof of concept script that showcases the issue can be found in the attachment. CRLFinjinsoupmessageheaderssetcontenttype.c Running this code confirms that the server on localhost:5000 receives a valid HTTP request containing the injected X-Injected-By header with the value injection.

Impact An attacker controlling the value used to set the Content-Type header is able to perform a CRLF injection, potentially leading to header injection and response splitting.

Recommended solution Instead of directly using the soupmessageheadersappendcommon() function, use the soupmessageheadersappend() function in soupmessageheaderssetcontenttype().

— Red Hat