DEBIAN-CVE-2026-3633
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-3633
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-3633.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-3633
- Upstream
- Published
- 2026-03-17T10:16:00Z
- Modified
- 2026-09-14T17:03:28Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the
soup_message_new()function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection. - References
Affected packages
Debian:12 / libsoup2.4
Package
- Name
- libsoup2.4
- Purl
- pkg:deb/debian/libsoup2.4?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:13 / libsoup2.4
Package
- Name
- libsoup2.4
- Purl
- pkg:deb/debian/libsoup2.4?arch=source&distro=trixie
Debian:12 / libsoup3
Package
- Name
- libsoup3
- Purl
- pkg:deb/debian/libsoup3?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
3.*
3.2.2-2
3.2.3-0+deb12u1
3.2.3-0+deb12u2
3.3.1-1
3.4.0-1
3.4.1-1
3.4.2-1
3.4.2-2
3.4.2-3
3.4.2-4
3.4.3-1
3.4.4-1
3.4.4-2
3.4.4-3
3.4.4-4
3.4.4-5
3.5.2-1
3.6.0-1
3.6.0-2
3.6.0-3
3.6.0-4
3.6.1-1
3.6.4-1
3.6.4-2
3.6.4-3
3.6.5-1
3.6.5-2
3.6.5-3
3.6.5-4
3.6.5-5
3.6.5-6
3.6.5-7
3.6.5-8
3.6.5-9
3.6.6-1
Debian:13 / libsoup3
Package
- Name
- libsoup3
- Purl
- pkg:deb/debian/libsoup3?arch=source&distro=trixie
Debian:14 / libsoup3
Package
- Name
- libsoup3
- Purl
- pkg:deb/debian/libsoup3?arch=source&distro=forky