CVE-2026-3633

A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.

• CWE-93

• https://access.redhat.com/security/cve/CVE-2026-3633Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2445128Issue Tracking, Vendor Advisory
• https://gitlab.gnome.org/GNOME/libsoup/-/issues/484Exploit, Issue Tracking, Vendor Advisory

Published

Mar 17, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-36239PbootCMS v.3.2.11 contains a code injection vulnerability in…4.3
• CVE-2026-3629The Import and export users and customers plugin for WordPre…8.1
• CVE-2026-3630Delta Electronics COMMGR2 has Stack-based Buffer Overflow …9.8
• CVE-2026-3631Delta Electronics COMMGR2 has Buffer Over-read DoS vulnera…7.5
• CVE-2026-3632A flaw was found in libsoup, a library used by applications …5.5
• CVE-2026-36324SourceCodester Doctor Appointment System 1.0 is vulnerable t…6.1
• CVE-2026-3634A flaw was found in libsoup. An attacker controlling the val…6.5
• CVE-2026-36340An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a…8.1
• CVE-2026-36341Cross-Site Scripting (XSS) vulnerability exists in Webkul Kr…5.4
• CVE-2026-3635Summary When trustProxy is configured with a restrictive tru…6.1
• CVE-2026-36355The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jun…7.7
• CVE-2026-36356The GoAhead web server on MeiG Smart FORGE_SLT711 devices (f…9.1