← volver
CVE-2026-3633

Libsoup: libsoup: header and http request injection via crlf injection

CVSS 3.9 LOWEPSS 0.2%CWE-93
Vexday Risk Score
8Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 3.9EPSS 0.2%KEV nãoPoC Nuclei Metasploit Patch
Ciclo de vida
17 mar 2026Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →