CVE-2026-1536: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-1536 is a CRLF injection vulnerability in libsoup, the GNOME HTTP client/server library, that allows an attacker who controls the Content-Disposition header input to inject arbitrary HTTP headers or perform HTTP response splitting. The flaw was disclosed on January 28, 2026, and affects GNOME libsoup (all versions tracked under cpe:2.3:a:gnome:libsoup) as well as Red Hat Enterprise Linux versions 6.0, 7.0, 8.0, 9.0, and 10.0. It carries a CVSS v3.1 base score of 5.3 (Medium) per NVD, or 5.8 (Medium) under the ENISA/EUVD scoring with a changed scope (Red Hat CVE, Red Hat Bugzilla).

The root cause is improper neutralization of CRLF sequences (CWE-93) in the soup_message_headers_set_content_disposition() function of libsoup. Internally, this function calls soup_message_headers_append_common(), which does not enforce character restrictions on header values, allowing \r\n sequences to pass through unfiltered (Red Hat Bugzilla). An attacker who can supply or influence the value used for the Content-Disposition header — for example, through a filename parameter in a multipart upload or a server-side response — can embed CRLF sequences that are then interpreted verbatim when the HTTP message is serialized, effectively injecting additional headers. No authentication or user interaction is required, and the attack is conducted over the network with low complexity (Red Hat CVE). A proof-of-concept issue is publicly documented in the GNOME GitLab tracker (GNOME GitLab).

Successful exploitation enables an attacker to inject arbitrary HTTP headers into requests or responses processed by libsoup, enabling HTTP response splitting, cache poisoning, session fixation, or bypassing of security controls such as Content Security Policy headers. The integrity impact is low and there is no direct confidentiality or availability impact per the CVSS scoring; however, chained with other weaknesses, injected headers could facilitate cross-site scripting, credential theft, or manipulation of downstream caches and proxies (Red Hat CVE, Red Hat Bugzilla).

A proof-of-concept is publicly available via the GNOME GitLab issue tracker as of March 25, 2026 (GNOME GitLab). As of the time of reporting, there is no evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.053% (0.000530), indicating a low probability of exploitation in the near term (Red Hat CVE). Detection plugins are available from Nessus (IDs 297046, 299657, 298468, 298737, 301358) and Qualys (IDs 761019, 917022).

1. Identify target: Locate an application or service using libsoup that accepts user-controlled input influencing the Content-Disposition header — for example, a web application that echoes a user-supplied filename in a multipart response or proxies user input into HTTP headers.
2. Craft malicious input: Prepare a payload containing CRLF sequences (e.g., filename="legit.txt\r\nX-Injected-Header: malicious-value") intended to be passed to soup_message_headers_set_content_disposition().
3. Submit the payload: Send the crafted input to the target application via an HTTP request (e.g., a file upload form, API call, or any endpoint that processes the Content-Disposition header value through libsoup).
4. Observe header injection: The CRLF sequences are passed unfiltered through soup_message_headers_append_common() and serialized verbatim into the HTTP response or request, causing the injected header to appear as a legitimate HTTP header.
5. Achieve objective: Leverage the injected header for cache poisoning (by injecting cache-control directives), session fixation (by injecting Set-Cookie), or HTTP response splitting to deliver malicious content to other users (Red Hat Bugzilla, GNOME GitLab).

• Network: HTTP responses or requests containing unexpected headers (e.g., duplicate Set-Cookie, Location, or custom headers) originating from a libsoup-based service; anomalous line breaks within header fields in captured traffic.
• Logs: Web server or application logs showing Content-Disposition header values containing URL-encoded or literal %0d%0a, \r\n, or \n sequences in filename or name parameters.
• Application Behavior: Unexpected HTTP headers appearing in responses that were not explicitly set by the application logic; cache entries containing injected headers or split responses.

A patch was released on March 25, 2026, tracked in the GNOME GitLab issue (GNOME GitLab); users should update libsoup to the patched version available from their distribution. Red Hat Enterprise Linux users (versions 6, 7, 8, 9, and 10) should apply security updates via Red Hat's advisory channels (Red Hat Bugzilla). Ubuntu users should apply USN-8020-1, and openSUSE/SUSE users should apply OPENSUSE-SU-2026:20186-1 or equivalent SUSE advisories. As a defense-in-depth measure, applications should validate and sanitize all user-supplied input before passing it to soup_message_headers_set_content_disposition(), rejecting any values containing CR (\r) or LF (\n) characters.

The vulnerability received coverage from Linux security news outlets including LinuxSecurity.com, pro-linux.de, and linuxcompatible.org, primarily in the context of distribution-level patch advisories for Ubuntu, SUSE, and openSUSE. A technical write-up was published by ctrlaltnod.com detailing the CRLF injection mechanism in libsoup's Content-Disposition handling (ctrlaltnod.com). Dell also published a security advisory (DSA-2026-214) referencing this CVE for affected products (Dell Advisory). Community reaction has been measured, consistent with the medium severity rating and absence of active exploitation.