CVE-2026-3634 Libsoup: libsoup: http header injection and response splitting via crlf injection in content-type header

Low 3.9 Published 17 Mar 2026 Updated 19 Mar 2026

Attackers can inject CRLF sequences into Content-Type headers, enabling HTTP header injection and response splitting attacks.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-3634?

CVE-2026-3634 is a low-severity vulnerability in Redhat Enterprise Linux, published on 17 Mar 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

A flaw was found in libsoup. An attacker controlling the value used to set the Content-Type header can inject a Carriage Return Line Feed (CRLF) sequence due to improper input sanitization in the `soup_message_headers_set_content_type()` function. This vulnerability allows for the injection of arbitrary header-value pairs, potentially leading to HTTP header injection and response splitting attacks.

Weakness: CWE-93

Which versions are affected by CVE-2026-3634?

It affects 2 products.

Products include Gnome Libsoup, Redhat Enterprise Linux.

How do I fix CVE-2026-3634?

Apply the vendor's patch.

Is CVE-2026-3634 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-3634 exists.

All Redhat Enterprise Linux vulnerabilities

Sources

Also known as AZL-80226, DEBIAN-CVE-2026-3634, ECHO-4911-1ada-38af, GHSA-jx6g-363c-pprr, UBUNTU-CVE-2026-3634.