CVE-2026-1467: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-1467 is a CRLF (Carriage Return Line Feed) Injection vulnerability in libsoup, an HTTP client library developed by GNOME. The flaw occurs when an HTTP proxy is configured and the library improperly handles URL-decoded input used to construct the Host header, allowing a remote attacker to inject arbitrary HTTP headers or complete HTTP request bodies via a specially crafted URL. Affected software includes GNOME libsoup (all versions tracked under CPE) and distributions shipping it, including Red Hat Enterprise Linux 6.0–10.0, Ubuntu, SUSE, and Amazon Linux 2023. The vulnerability was first reported on January 27, 2026, and has a CVSS v3.1 base score of 5.3 (Medium) per NVD, though ENISA rates it 6.1 (Medium) under a different vector (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-93 (Improper Neutralization of CRLF Sequences — 'CRLF Injection'). The vulnerability exists in the SoupSession request creation workflow, where URL-decoded input is used to populate the HTTP Host header without adequate sanitization of CRLF sequences (\r\n). An attacker who can supply a crafted URL containing embedded CRLF sequences to a victim application using libsoup with an HTTP proxy configured can cause the library to emit additional, attacker-controlled HTTP headers or inject entire request bodies into the proxied HTTP stream. Exploitation requires the victim application to process an attacker-controlled URL while routing traffic through an HTTP proxy; it does not require authentication or user interaction beyond the application processing the URL (Red Hat Bugzilla, GNOME GitLab Issue).

Successful exploitation allows an attacker to inject arbitrary HTTP headers or request bodies into proxied HTTP traffic, potentially enabling HTTP request smuggling, cache poisoning, or unauthorized requests forwarded to downstream services. The primary impact is on integrity (low), with no direct confidentiality or availability impact to the client system itself. However, downstream services receiving the manipulated requests may be affected in ways that extend the blast radius, including unauthorized actions performed on behalf of the victim application (Red Hat Bugzilla, Red Hat CVE).

The vulnerability is network-exploitable with low attack complexity and requires no privileges or user interaction (per the NVD CVSS vector). A reference to the issue tracker at GNOME GitLab has been listed as an exploit reference by NVD, though no weaponized public exploit code or active in-the-wild exploitation has been confirmed (GNOME GitLab Issue). The EPSS score is approximately 0.039% (0.000390), indicating a low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Nessus (IDs: 296742, 300863, 301284, 301306, 301413, 301458, 302341, 316949) and Qualys (IDs: 917019, 761634, 761693) (Feedly).

1. Identify a target application: Find an application that uses libsoup as its HTTP client library and is configured to route requests through an HTTP proxy.
2. Craft a malicious URL: Construct a URL containing URL-encoded CRLF sequences (e.g., %0d%0a or %0D%0A) embedded in the hostname or path portion, such as http://legitimate-host%0d%0aInjected-Header:%20value@proxy/path.
3. Supply the URL to the target application: Deliver the crafted URL to the victim application through any available input vector (e.g., a redirect, user-supplied link, API parameter, or configuration value that the application fetches via libsoup).
4. Trigger the proxied request: When the application uses libsoup to make an HTTP request with the crafted URL through the configured proxy, the library constructs the Host header using the URL-decoded (and unsanitized) input, embedding the CRLF sequences into the raw HTTP stream.
5. Achieve header/request injection: The injected CRLF sequences terminate the original header and introduce attacker-controlled headers or a complete second HTTP request body, which the proxy forwards to the downstream service — potentially enabling cache poisoning, request smuggling, or unauthorized actions (Red Hat Bugzilla, GNOME GitLab Issue).

• Network: HTTP requests observed at the proxy containing unexpected additional headers or split request bodies originating from a libsoup-based client; requests with %0d%0a, %0D%0A, or literal CRLF sequences in the Host header value as seen in proxy access logs.
• Logs: Proxy access logs showing malformed or duplicate HTTP requests from the same source IP in rapid succession; HTTP requests with unusual or unexpected headers (e.g., injected X-Forwarded-For, Transfer-Encoding, or custom headers) not generated by the application logic.
• Application Behavior: Downstream services receiving requests that do not correspond to any legitimate application action; unexpected HTTP method changes or additional request bodies forwarded by the proxy.

Patches have been issued by multiple downstream distributors. Ubuntu released USN-8020-1 addressing this vulnerability in libsoup packages (Ubuntu Advisory). SUSE and openSUSE have published security announcements and updated packages via their security mailing lists. Amazon Linux 2023 addressed the issue in ALAS2023-2026-1758 and ALAS2023-2026-1778. Red Hat has tracked the issue and published guidance via their CVE portal. Users should update libsoup to the patched version provided by their Linux distribution as the primary remediation. As a workaround where patching is not immediately possible, avoid configuring HTTP proxies in libsoup-based applications that process untrusted or attacker-influenced URLs, and sanitize or validate URLs before passing them to libsoup (Red Hat CVE, Ubuntu Advisory, GNOME GitLab Issue).

The vulnerability received coverage from Linux security news outlets including LinuxSecurity.com and pro-linux.de, which reported on the libsoup updates across multiple distributions. The Yocto Project security mailing list also flagged the issue for embedded Linux users. Community reaction has been measured, consistent with the moderate CVSS score and the requirement for a proxy configuration as a precondition. No notable researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking and distribution advisory channels (Ubuntu Advisory, Red Hat CVE).