CVE-2026-3633: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-3633 is a CRLF injection vulnerability in GNOME's libsoup HTTP client library, allowing a remote attacker who controls the method parameter of the soup_message_new() function to inject arbitrary HTTP headers and additional request data. The flaw was first reported on March 6, 2026, and published to NVD on March 17, 2026. It affects GNOME libsoup (all versions under the tracked CPE) and systems running Red Hat Enterprise Linux 6.0 through 10.0. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium/High) per Feedly threat intelligence data (Red Hat CVE, Red Hat Bugzilla).

The root cause is CWE-93 (Improper Neutralization of CRLF Sequences), classified as a CRLF injection flaw. In libsoup's request construction code, the g_string_append_printf() function builds the HTTP request line using the format string "%s %s HTTP/1.%d\r\n" with the method value inserted directly and without escaping or validation. If an attacker controls the method argument passed to soup_message_new(), they can embed \r\n sequences to terminate the request line prematurely and inject arbitrary headers or body content. The attack is network-accessible, requires no privileges, and no user interaction, making it straightforward to exploit in applications that pass user-controlled input to this API (Red Hat Bugzilla, GNOME GitLab).

Successful exploitation allows an attacker to inject arbitrary HTTP headers and additional request data into outbound HTTP requests made by applications using libsoup, potentially enabling HTTP request smuggling, cache poisoning, session hijacking, or bypassing security controls on intermediate proxies. The confidentiality and integrity impacts are rated Low each, with no direct availability impact, as the attacker can read or manipulate HTTP traffic but cannot directly crash the service. Applications that pass user-supplied data as the HTTP method to libsoup are most at risk, and the vulnerability could facilitate further attacks against backend systems or other clients sharing the same HTTP infrastructure (Red Hat CVE, Red Hat Bugzilla).

No public exploit code or weaponized exploit kit has been confirmed for CVE-2026-3633 as of the latest available data; the GNOME GitLab issue tracker entry was assessed as non-exploitable in its current form. The EPSS score is approximately 0.106%, indicating a low probability of exploitation in the wild in the near term. There is no evidence of active in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Nessus plugin 301506 has been released to detect this vulnerability (Red Hat CVE, Tenable).

1. Identify vulnerable applications: Locate applications that use libsoup and pass user-controlled input as the HTTP method argument to soup_message_new() — this is the prerequisite for exploitation.
2. Craft a malicious method string: Construct a method value containing CRLF sequences, for example: GET / HTTP/1.1\r\nX-Injected-By: injection\r\nFoo: — this terminates the intended request line and injects a new header.
3. Trigger the vulnerable code path: Supply the crafted method string to the target application so it is passed to soup_message_new(), causing libsoup to build a malformed HTTP request line via g_string_append_printf() without escaping.
4. Observe injected headers: The server receiving the request will process the injected headers (e.g., X-Injected-By: injection) as legitimate, enabling header injection, HTTP request smuggling, or cache poisoning depending on the server and proxy configuration (Red Hat Bugzilla, GNOME GitLab).

• Network: Outbound HTTP requests from libsoup-based applications containing unexpected or duplicate headers (e.g., X-Injected-By, extra Host headers, or malformed request lines) visible in proxy or network capture logs.
• Logs: HTTP server access logs showing requests with unusual method strings containing encoded CRLF sequences (%0d%0a or literal \r\n) or unexpected header fields not generated by the application.
• Application Behavior: Unexpected HTTP responses or server-side errors triggered by malformed requests; anomalous behavior in applications that proxy or forward libsoup-generated requests to backend services.

The recommended fix is to sanitize or refuse method values containing invalid characters — including any form of whitespace or CRLF sequences — before passing them to soup_message_new(). Developers should validate that the HTTP method is a valid token (per RFC 7230) before use. Red Hat has tracked this issue and a patch is expected; users should monitor the Red Hat advisory and GNOME libsoup release notes for a fixed version and apply updates as soon as they become available. As a workaround, applications should never pass user-controlled input directly as the HTTP method parameter without strict allowlist validation (Red Hat CVE, Red Hat Bugzilla, GNOME GitLab).

The vulnerability was reported via Red Hat's OSIDB system and tracked in Red Hat Bugzilla with a low severity/priority rating, reflecting its limited direct impact. The Yocto Project security mailing list has referenced this CVE in recurring CVE metrics reports, indicating awareness in the embedded Linux community. No significant public researcher commentary, social media discussion, or major media coverage has been identified for this vulnerability.