Low severity3.9NVD Advisory· Published Mar 17, 2026· Updated Jun 17, 2026
CVE-2026-3634
CVE-2026-3634
Description
A flaw was found in libsoup. An attacker controlling the value used to set the Content-Type header can inject a Carriage Return Line Feed (CRLF) sequence due to improper input sanitization in the soup_message_headers_set_content_type() function. This vulnerability allows for the injection of arbitrary header-value pairs, potentially leading to HTTP header injection and response splitting attacks.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
12cpe:/o:redhat:enterprise_linux:10+ 9 more
- cpe:/o:redhat:enterprise_linux:10
- cpe:/o:redhat:enterprise_linux:6
- cpe:/o:redhat:enterprise_linux:7
- cpe:/o:redhat:enterprise_linux:8
- cpe:/o:redhat:enterprise_linux:9
- cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:a:gnome:libsoup:-:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:gnome:libsoup:-:*:*:*:*:*:*:*
- (no CPE)
Patches
Vulnerability mechanics
References
3- gitlab.gnome.org/GNOME/libsoup/-/issues/485nvdExploitIssue TrackingVendor Advisory
- access.redhat.com/security/cve/CVE-2026-3634nvdVendor Advisory
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingVendor Advisory
News mentions
0No linked articles in our index yet.