CVE-2026-3633: Gnome Libsoup RCE Vulnerability

CVE-2026-3633 Overview

A CRLF (Carriage Return Line Feed) injection flaw exists in libsoup, the GNOME HTTP client/server library used across numerous Linux desktop and server components. A remote attacker who controls the method parameter passed to soup_message_new() can inject arbitrary HTTP headers and additional request data into outbound requests. The library fails to escape the method value during request line construction, allowing attackers to smuggle headers or entire follow-up requests. This affects applications that build HTTP requests from untrusted input and impacts Red Hat Enterprise Linux versions 6 through 10. The issue is tracked as [CWE-93] (Improper Neutralization of CRLF Sequences).

Critical Impact
Remote attackers can inject arbitrary HTTP headers and request data through unsanitized method parameters, enabling HTTP request injection against backend services.

Affected Products

GNOME libsoup (all versions prior to fix)
Red Hat Enterprise Linux 6, 7, 8, 9, and 10
Applications consuming libsoup for HTTP client functionality

Discovery Timeline

2026-03-17 - CVE-2026-3633 published to NVD
2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-3633

Vulnerability Analysis

The vulnerability resides in libsoup's request construction logic, specifically in soup_message_new(). This function accepts an HTTP method string and a URI to build a new SoupMessage object. The method parameter is concatenated directly into the HTTP request line without validation or neutralization of control characters.

When an application passes attacker-influenced data as the method argument, embedded CR (\r) and LF (\n) bytes terminate the request line prematurely. Subsequent bytes are interpreted as additional headers or a new request body by the receiving server. This enables HTTP request injection, header smuggling, and in proxy scenarios, potential request splitting against downstream services.

The impact depends on how consuming applications use libsoup. Software that derives HTTP methods from user input, configuration files, or remote APIs is directly exposed. Confidentiality and integrity are affected, while availability remains unimpacted.

Root Cause

The root cause is missing input neutralization in the HTTP request line builder. The method string is treated as trusted and copied verbatim into the wire format. libsoup does not enforce the RFC 7230 token grammar for method values, which forbids CR, LF, and whitespace characters.

Attack Vector

Exploitation requires the attacker to influence the value passed to the method argument of soup_message_new() in a vulnerable application. The attack is network-based, requires no authentication, and no user interaction. A crafted payload such as GET\r\nInjected-Header: value\r\n\r\n causes the library to emit a malformed request containing attacker-controlled headers.

The vulnerability is described in prose only. Refer to the GNOME Issue #484 Discussion and the Red Hat Bugzilla Report #2445128 for technical details of the request line construction path.

Detection Methods for CVE-2026-3633

Indicators of Compromise

Outbound HTTP requests containing unexpected headers immediately following the request method token.
Application logs showing HTTP method values containing CR/LF byte sequences or non-token characters.
Web server or proxy logs reporting malformed request lines or unexpected pipelined requests originating from libsoup-based clients.

Detection Strategies

Audit source code for calls to soup_message_new() where the method argument is derived from untrusted input.
Inspect network captures for HTTP request lines containing embedded %0d%0a or raw CRLF sequences in the method position.
Run package inventory queries against affected Red Hat Enterprise Linux hosts to identify unpatched libsoup installations.

Monitoring Recommendations

Enable verbose HTTP egress logging on hosts running libsoup-dependent services and forward logs to a centralized analytics platform.
Monitor for anomalous outbound request patterns from desktop and server applications using GNOME HTTP libraries.
Track vendor advisories from Red Hat and GNOME for follow-on fixes and regression notices.

How to Mitigate CVE-2026-3633

Immediate Actions Required

Apply distribution-supplied libsoup updates as they become available from Red Hat and GNOME.
Inventory applications linking against libsoup and identify those that build HTTP requests from user-controllable methods.
Validate method values at the application layer, rejecting any input containing characters outside the RFC 7230 token grammar.

Patch Information

Patch availability and tracking are maintained in the Red Hat CVE-2026-3633 Advisory and the upstream GNOME Issue #484 Discussion. Consult the Red Hat Bugzilla Report #2445128 for per-release backport status across Red Hat Enterprise Linux 6 through 10.

Workarounds

Reject HTTP method strings containing CR, LF, whitespace, or any non-token characters before invoking soup_message_new().
Restrict callable HTTP methods to a hardcoded allowlist such as GET, POST, PUT, DELETE, HEAD, OPTIONS, and PATCH.
Route libsoup-generated traffic through an egress proxy that normalizes or rejects malformed request lines.

bash

# Configuration example: validate HTTP method before constructing requests
# Pseudocode for application-layer mitigation
validate_method() {
  method="$1"
  case "$method" in
    GET|POST|PUT|DELETE|HEAD|OPTIONS|PATCH) return 0 ;;
    *) echo "Invalid HTTP method rejected"; return 1 ;;
  esac
}