CRLF Injection in Libsoup Enables HTTP Header Injection

Publication date: 2026-01-28

Last updated on: 2026-03-25

Assigner: Red Hat, Inc.

Description

A flaw was found in libsoup. An attacker who can control the input for the Content-Disposition header can inject CRLF (Carriage Return Line Feed) sequences into the header value. These sequences are then interpreted verbatim when the HTTP request or response is constructed, allowing arbitrary HTTP headers to be injected. This vulnerability can lead to HTTP header injection or HTTP response splitting without requiring authentication or user interaction.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-28

Last Modified

2026-03-25

Generated

2026-07-06

AI Q&A

2026-01-29

EPSS Evaluated

2026-07-05

NVD

CVE-2026-1536

EUVD

EUVD-2026-4887

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	enterprise_linux	7.0
redhat	enterprise_linux	6.0
redhat	enterprise_linux	8.0
redhat	enterprise_linux	9.0
redhat	enterprise_linux	10.0
gnome	libsoup	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

This vulnerability is a flaw in libsoup where an attacker who can control the Content-Disposition header input can inject CRLF (Carriage Return Line Feed) sequences into the header value. These sequences are interpreted literally when constructing HTTP requests or responses, allowing the attacker to inject arbitrary HTTP headers. This can lead to HTTP header injection or HTTP response splitting without needing authentication or user interaction.

Impact Analysis

The vulnerability can allow an attacker to inject arbitrary HTTP headers or split HTTP responses, which can be exploited to manipulate web traffic, perform cache poisoning, cross-site scripting (XSS), or other attacks that rely on controlling HTTP headers. This can compromise the integrity of web communications and potentially lead to further exploitation.

Hi! I’m here to help you understand CVE-2026-1536. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70