AZL-80232

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-80232.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-80232

Upstream

CVE-2026-3633

Published

2026-03-17T10:16:00Z

Modified

2026-08-30T05:26:50Z

Summary

CVE-2026-3633 affecting package libsoup 3.4.4-16

Details

A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the soup_message_new() function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-3633

Affected packages

Azure Linux:3 / libsoup

Package

Name: libsoup
Purl: pkg:rpm/azure-linux/libsoup

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

3.4.4-16

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-80232.json"