A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF (Carriage Return Line Feed) Injection, occurs when an HTTP proxy is configured and the library improperly handles URL-decoded input used to create the Host header. A remote attacker can exploit this by providing a specially crafted URL containing CRLF sequences, allowing them to inject additional HTTP headers or complete HTTP request bodies. This can lead to unintended or unauthorized HTTP requests being forwarded by the proxy, potentially impacting downstream services.
CVSS Details
- CVSS 3.1 Base Score: 5.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade libsoup3-develUpgrade libsoup-develUpgrade libsoup3-debugsourceUpgrade libsoup-docUpgrade libsoupUpgrade libsoup3Upgrade libsoup3-debuginfoUpgrade libsoup-debuginfoUpgrade libsoup-debugsourceUpgrade libsoup3-doc | May 28, 2026 | Jan 27, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Jan 27, 2026 |
| Suse | — | Upgrade libsoup2-devel-32bitUpgrade libsoup-3_0-0Upgrade libsoup-2_4-1-32bitUpgrade libsoup-develUpgrade libsoup-2_4-1Upgrade libsoup-langUpgrade typelib-1_0-Soup-3_0Upgrade typelib-1_0-Soup-2_4Upgrade libsoup-devel-32bitUpgrade libsoup-3_0-0-32bitUpgrade libsoup2-develUpgrade libsoup2-lang | Mar 4, 2026 | Mar 3, 2026 |
| Ubuntu | — | Upgrade libsoup-gnome-2.4-1Upgrade libsoup2.4-commonUpgrade libsoup-3.0-dev (Ubuntu Pro)Upgrade gir1.2-soup-3.0 (Ubuntu Pro)Upgrade gir1.2-soup-3.0Upgrade libsoup-3.0-docUpgrade libsoup2.4-devUpgrade libsoup-3.0-doc (Ubuntu Pro)Upgrade libsoup-gnome2.4-1Upgrade libsoup-gnome2.4-1 (Ubuntu Pro)Upgrade libsoup-3.0-common (Ubuntu Pro)Upgrade libsoup-3.0-tests (Ubuntu Pro)Upgrade libsoup-2.4-1Upgrade libsoup-gnome2.4-devUpgrade libsoup-gnome-2.4-1 (Ubuntu Pro)Upgrade libsoup-3.0-0 (Ubuntu Pro)Upgrade libsoup2.4-dev (Ubuntu Pro)Upgrade libsoup-3.0-commonUpgrade libsoup-3.0-0Upgrade gir1.2-soup-2.4Upgrade libsoup2.4-common (Ubuntu Pro)Upgrade libsoup2.4-1Upgrade libsoup-2.4-1 (Ubuntu Pro)Upgrade libsoup-3.0-devUpgrade libsoup2.4-1 (Ubuntu Pro)Upgrade gir1.2-soup-2.4 (Ubuntu Pro)Upgrade libsoup-3.0-testsUpgrade libsoup-gnome2.4-dev (Ubuntu Pro) | Feb 10, 2026 | Jan 27, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub