CVE-2026-1467
CRLF Injection in Libsoup HTTP Proxy Enables Header Injection
Publication date: 2026-01-27
Last updated on: 2026-03-25
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| redhat | enterprise_linux | 7.0 |
| redhat | enterprise_linux | 6.0 |
| redhat | enterprise_linux | 8.0 |
| redhat | enterprise_linux | 9.0 |
| redhat | enterprise_linux | 10.0 |
| gnome | libsoup | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-93 | The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a CRLF (Carriage Return Line Feed) injection flaw in the libsoup HTTP client library when an HTTP proxy is configured. It happens because the library improperly handles URL-decoded input used to create the Host header. An attacker can exploit this by sending a specially crafted URL containing CRLF sequences, which allows them to inject additional HTTP headers or complete HTTP request bodies into the HTTP request. This can cause the proxy to forward unintended or unauthorized HTTP requests. [1]
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to unauthorized or unintended HTTP requests being forwarded by the proxy to downstream services. While it does not directly compromise the client system, it can affect the behavior of services behind the proxy, potentially leading to security issues such as request smuggling or manipulation of HTTP traffic. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that any HTTP proxy configurations using libsoup are updated to a version where the CRLF injection flaw is fixed. Avoid processing attacker-controlled URLs through an HTTP proxy with vulnerable libsoup versions. Applying vendor patches or updates that address this issue is recommended to prevent exploitation. [1]