CVE-2026-3633
LOW
3,9
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: high
User Interaction: required
Scope: unchanged
Confidentiality: low
Integrity: low
Availability: low
Description
AI Translation Available
A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0011
Percentile
0,3th
Updated
Single Data Point
Only one EPSS measurement is available for this CVE. Trend analysis requires multiple data points over time.
93
Improper Neutralization of CRLF Sequences ('CRLF Injection')
DraftCommon Consequences
Security Scopes Affected:
Integrity
Potential Impacts:
Modify Application Data
Applicable Platforms
All platforms may be affected
https://access.redhat.com/security/cve/CVE-2026-3633
https://bugzilla.redhat.com/show_bug.cgi?id=2445128
https://gitlab.gnome.org/GNOME/libsoup/-/issues/484