CVE-2026-3634: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-3634 is a CRLF injection vulnerability in GNOME's libsoup HTTP client/server library, specifically in the soup_message_headers_set_content_type() function. An attacker who controls the value used to set the Content-Type header can inject Carriage Return Line Feed (CRLF) sequences, enabling HTTP header injection and response splitting attacks. The vulnerability affects GNOME libsoup (all versions tracked under CPE) and is present in Red Hat Enterprise Linux 6, 7, 8, 9, and 10. It was first reported on March 6, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper neutralization of CRLF sequences (CWE-93) in the soup_message_headers_set_content_type() function. Internally, this function calls soup_message_headers_append_common() to add the Content-Type value to an accumulating header array; unlike the public soup_message_headers_append() function, this internal variant does not enforce restrictions on allowed characters, permitting CRLF sequences in header values. When the HTTP request or response is subsequently constructed, the header strings are interpreted without further sanitization, causing the injected CRLF to be treated as a header delimiter — effectively allowing arbitrary header-value pairs to be inserted. A proof-of-concept C program (CRLF_inj_in_soup_message_headers_set_content_type.c) demonstrating injection of a custom X-Injected-By header was included in the bug report (Red Hat Bugzilla). The recommended fix is to replace the internal soup_message_headers_append_common() call with the sanitizing soup_message_headers_append() function (Red Hat Bugzilla).

Successful exploitation allows an unauthenticated network attacker to inject arbitrary HTTP headers into requests or responses generated by applications using libsoup, enabling HTTP response splitting. This can lead to cache poisoning, cross-site scripting (XSS) via injected content, session hijacking, or redirection of users to malicious sites. The confidentiality and integrity impacts are rated low, with no direct availability impact, as the attacker can manipulate HTTP communication but cannot directly execute code or crash the service (Red Hat Advisory, Red Hat Bugzilla).

No confirmed in-the-wild exploitation has been observed, and no weaponized exploit kits are known to incorporate this vulnerability. A proof-of-concept C program was attached to the Red Hat Bugzilla report demonstrating the injection, but Feedly's analysis assessed the referenced GitLab issue as non-exploitable in its current public form. The EPSS score is approximately 0.03% (very low probability of exploitation in the near term), and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog (Red Hat Bugzilla, Red Hat Advisory).

1. Identify a target application: Find an application that uses libsoup to construct HTTP requests or responses and allows external input to influence the Content-Type header value (e.g., via user-supplied MIME type parameters).
2. Craft a malicious Content-Type value: Prepare a Content-Type string containing an embedded CRLF sequence followed by an arbitrary header, for example: text/html\r\nX-Injected-By: injection.
3. Trigger the vulnerable function: Supply the crafted value to any code path that calls soup_message_headers_set_content_type() with attacker-controlled input, causing the internal soup_message_headers_append_common() to store the unsanitized value.
4. Observe header injection: When the HTTP message is serialized and transmitted, the CRLF sequence is interpreted as a header delimiter, causing the injected header (X-Injected-By: injection) to appear as a legitimate header in the HTTP request or response received by the peer.
5. Leverage for response splitting: Extend the injected content to include a full HTTP response body, enabling cache poisoning or delivery of malicious content to downstream clients or proxies (Red Hat Bugzilla).

• Network: HTTP requests or responses containing unexpected headers (e.g., X-Injected-By, or other non-standard headers) originating from libsoup-based applications; HTTP responses with duplicate or anomalous Content-Type lines.
• Logs: Application or web server logs showing Content-Type header values containing URL-encoded or raw %0d%0a (\r\n) sequences; unexpected HTTP 200 responses embedded within a single HTTP transaction (response splitting artifact).
• Application Behavior: Clients receiving unexpected redirects or injected content from a libsoup-based server; proxy or CDN cache entries containing attacker-controlled content attributed to a legitimate origin.

The recommended fix is to update libsoup so that soup_message_headers_set_content_type() uses the sanitizing soup_message_headers_append() function instead of the internal soup_message_headers_append_common(). Users should apply patches provided by their Linux distribution (e.g., Red Hat Enterprise Linux updates via dnf update libsoup). As a workaround, application developers should validate and sanitize all Content-Type header values at the application level, rejecting any input containing \r or \n characters before passing them to libsoup (Red Hat Bugzilla, Red Hat Advisory).

The vulnerability was tracked by the Yocto Project security team, which referenced it in multiple CVE metrics reports across their mailing list, indicating awareness in the embedded Linux community (Yocto Security List). No significant public researcher commentary, vendor blog posts, or notable social media discussion has been identified beyond standard vulnerability database aggregation.