CVE-2026-3633CWE-93

Libsoup: libsoup: header and http request injection via crlf injection

Low · published March 17, 2026

CVSS v3.1
3.9
EPSS
0%
Percentile
31.5
In the wild
Unconfirmed
What it is

A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.

The record
Technical detail
CVSS v3.1
3.9 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00386 · 31.5th percentile
Weakness
CWE-93 · Improper Neutralization of CRLF Sequences ('CRLF Injection')
Published
2026-03-17T09:44Z
EPSS history
Timeline
  • 17 MAR 09:44Z
    Libsoup: libsoup: header and http request injection via crlf injection
    cvelistv5