CVE-2026-3632: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-3632 is an HTTP smuggling and Server-Side Request Forgery (SSRF) vulnerability in libsoup, a GNOME library used by applications to send network requests. The flaw arises because libsoup does not properly validate hostnames, allowing special characters (including CRLF sequences) to be injected into HTTP headers. It affects GNOME libsoup (all versions tracked under CPE) and systems running Red Hat Enterprise Linux 6.0 through 10.0. The vulnerability was first reported on March 6, 2026, and published to NVD on March 17, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) per Feedly/NVD, though Red Hat's own scoring assigns it 3.9 (Low) (Red Hat Advisory, Red Hat Bugzilla).

The root cause (CWE-1286: Improper Validation of Syntactic Correctness of Input) lies in soup_message_set_request_host_from_uri(), which is called by soup_session_send_queue_item() when constructing outbound HTTP requests. This function retrieves the host component from a GUri via g_uri_get_host() and inserts it literally as the Host header value without sanitizing special characters. Because GUri permits arbitrary characters — including \r and \n — in the host component, an attacker who controls the URL can inject CRLF tokens into the Host header, effectively inserting arbitrary additional headers or even complete HTTP requests. For example, a crafted URL such as http://a%0d%0a%0d%0aPOST%20%2ffoo%20HTTP%2f1.1%0d%0aHost%3a%20localhost%0d%0aA%3a%20.localhost:8080/a causes downstream HTTP servers (e.g., nginx) to interpret the single connection as two separate requests, enabling HTTP request smuggling (Red Hat Bugzilla, GNOME GitLab Issue).

Successful exploitation allows an authenticated remote attacker (with user interaction) to inject hidden HTTP requests alongside legitimate ones, potentially achieving SSRF — forcing the affected application to make unauthorized GET or POST requests to internal or external systems. A concrete real-world scenario involves LibreOffice processing a malicious document containing a crafted remote image URL: when LibreOffice (using GIO/GVfs/libsoup) fetches the URL, it sends an attacker-controlled POST request to an arbitrary target, constituting SSRF with a fully controllable request body. The confidentiality, integrity, and availability impacts are each rated low, and the overall impact is limited because SoupServer is not widely deployed in internet-facing infrastructure (Red Hat Bugzilla, Red Hat Advisory).

No confirmed public exploit or proof-of-concept code is currently available; the GNOME GitLab issue referenced as a potential exploit source was found to contain no exploit details (GNOME GitLab Issue). Exploitation requires an authenticated attacker and user interaction (e.g., a victim opening a malicious document), limiting opportunistic exploitation. The EPSS score is approximately 0.00129 (~0.13%), indicating a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (Feedly).

1. Craft a malicious URL: Construct a URL with CRLF sequences percent-encoded in the hostname component, e.g., http://a%0d%0a%0d%0aPOST%20%2ffoo%20HTTP%2f1.1%0d%0aHost%3a%20localhost%0d%0aA%3a%20.localhost:8080/a, designed to inject a secondary HTTP request.
2. Embed the URL in a document: Insert the crafted URL as a remote image path or hyperlink in a document format supported by LibreOffice (e.g., ODT, DOCX) or another application that uses GIO/GVfs/libsoup for remote resource fetching.
3. Deliver the document to the victim: Send the malicious document to a target user or upload it to a server where it will be processed by a headless LibreOffice instance (e.g., via libreoffice-convert for PDF conversion).
4. Trigger the request: When the victim opens the document (or the server processes it), libsoup's soup_message_set_request_host_from_uri() inserts the unsanitized hostname — including the injected CRLF and payload — directly into the Host header.
5. HTTP smuggling occurs: The downstream HTTP server (e.g., nginx) parses the malformed request as two separate HTTP requests, processing both the legitimate GET and the injected POST.
6. Achieve SSRF: The injected POST request is sent to the attacker-specified internal or external target, potentially accessing internal APIs, metadata services, or other restricted endpoints (Red Hat Bugzilla).

• Network: Outbound HTTP requests from application servers (e.g., LibreOffice conversion services) to unexpected internal or external hosts; HTTP server logs showing two requests processed from a single connection where only one was expected (e.g., an unexpected POST immediately following a GET from the same client).
• Logs: Web server access logs (nginx, Apache) showing a POST request attributed to a non-browser user-agent (e.g., gvfs/1.54.x) immediately after a GET from the same IP; requests to unusual internal endpoints (e.g., metadata services at 169.254.169.254) originating from document processing services.
• File System: Malicious documents (ODT, DOCX, etc.) containing remote image or hyperlink URLs with percent-encoded CRLF sequences (%0d%0a) in the hostname portion.
• Process: Unexpected network connections initiated by soffice, libreoffice, or gvfsd processes to internal network addresses or cloud metadata endpoints (Red Hat Bugzilla).

The recommended fix is to update libsoup to a patched version that ensures hostname components cannot contain invalid characters, and that performs additional validation on header values before they are set. Red Hat has tracked this issue and patch details are available via the Red Hat Bugzilla entry. As a workaround, administrators should restrict outbound network access for applications using libsoup (e.g., LibreOffice conversion services) using firewall rules or network policies, and monitor for suspicious outbound HTTP requests. Avoid processing untrusted documents with headless LibreOffice or similar tools until the patch is applied (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability was tracked by the Yocto Project security mailing list across multiple updates, indicating awareness in the embedded Linux community (Yocto Security List). Security aggregators including Tenable (Nessus plugin 301505), VulnDB, and ENISA's EUVD catalogued the issue shortly after disclosure. No significant public researcher commentary, vendor blog posts, or social media discussion beyond routine CVE tracking has been observed for this vulnerability.