CVE-2026-3634: Gnome Libsoup HTTP Header Injection Flaw

CVE-2026-3634 Overview

A HTTP header injection vulnerability has been identified in GNOME libsoup, a popular HTTP client/server library for GNOME. The flaw exists in the soup_message_headers_set_content_type() function, which fails to properly sanitize input values used when setting the Content-Type header. An attacker who controls the value passed to this function can inject Carriage Return Line Feed (CRLF) sequences, enabling the injection of arbitrary HTTP headers.

This vulnerability allows for HTTP header injection and response splitting attacks, which can lead to various security issues including cache poisoning, cross-site scripting via response manipulation, and session fixation attacks.

Critical Impact

Attackers can inject arbitrary HTTP headers through CRLF sequences in Content-Type values, enabling HTTP response splitting attacks that may compromise application security and user sessions.

Affected Products

• GNOME libsoup (all versions prior to patch)
• Red Hat Enterprise Linux 6.0
• Red Hat Enterprise Linux 7.0
• Red Hat Enterprise Linux 8.0
• Red Hat Enterprise Linux 9.0
• Red Hat Enterprise Linux 10.0

Discovery Timeline

• 2026-03-17 - CVE CVE-2026-3634 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-3634

Vulnerability Analysis

The vulnerability is classified as CWE-93 (Improper Neutralization of CRLF Sequences) and stems from inadequate input validation in the libsoup HTTP library. When applications use the soup_message_headers_set_content_type() function to set Content-Type headers, the function does not properly filter or escape CRLF character sequences (\r\n) from user-controlled input.

HTTP headers are delimited by CRLF sequences, so when an attacker injects these characters into a header value, they can effectively terminate the current header and begin a new one. This breaks the expected HTTP message structure and allows the attacker to inject completely new headers or even manipulate the HTTP response body.

The network-based attack vector means this vulnerability can be exploited remotely without requiring authentication. The impact primarily affects confidentiality and integrity of communications, while availability remains unaffected.

Root Cause

The root cause lies in missing input sanitization within the soup_message_headers_set_content_type() function. The function accepts untrusted input for the Content-Type header value without stripping or encoding CRLF sequences (\r and \n characters). This oversight allows specially crafted input to break out of the header context and inject additional headers or manipulate the HTTP response structure.

Proper remediation requires the function to either reject input containing CRLF characters or encode them appropriately before incorporating the value into the HTTP header.

Attack Vector

The attack is network-based and requires no user interaction or special privileges. An attacker must be able to control the value passed to the soup_message_headers_set_content_type() function, which typically occurs when applications accept user input for content type specification without proper validation.

A successful attack involves crafting a malicious Content-Type value that includes CRLF sequences followed by attacker-controlled header names and values. For example, an attacker might inject a value like text/html\r\nX-Injected-Header: malicious-value\r\n which would result in an additional header being added to the HTTP message.

This can be leveraged for various attacks including:

• HTTP response splitting to serve malicious content
• Cache poisoning to affect other users
• Session fixation by injecting session-related headers
• Cross-site scripting when browsers interpret injected content

Detection Methods for CVE-2026-3634

Indicators of Compromise

• Unexpected CRLF sequences (%0d%0a or \r\n) appearing in HTTP Content-Type headers within application logs
• HTTP responses containing unexpected or duplicate headers
• Evidence of cache poisoning or anomalous cached responses
• Application logs showing malformed Content-Type values with embedded line breaks

Detection Strategies

• Monitor web application firewalls (WAF) for CRLF injection attempts in Content-Type parameters
• Implement log analysis rules to detect %0d, %0a, \r, or \n sequences in HTTP header values
• Review application source code for usage of soup_message_headers_set_content_type() with user-controlled input
• Deploy intrusion detection signatures targeting HTTP header injection patterns

Monitoring Recommendations

• Enable verbose logging on applications using libsoup to capture HTTP header details
• Configure SIEM rules to alert on CRLF patterns in HTTP traffic
• Monitor for unusual HTTP response structures that may indicate response splitting
• Implement regular security scans to identify applications using vulnerable libsoup versions

How to Mitigate CVE-2026-3634

Immediate Actions Required

• Review all applications using libsoup for calls to soup_message_headers_set_content_type() with user-controlled input
• Implement input validation to strip or reject CRLF characters before passing values to libsoup functions
• Update to patched versions of libsoup when available from GNOME or your distribution vendor
• Apply Red Hat Enterprise Linux security updates as they become available

Patch Information

Patches and security updates are being tracked through official vendor channels. System administrators should monitor the Red Hat CVE Advisory and GNOME libsoup Issue Tracker for patch availability. Additional details are available in the Red Hat Bug Report.

For Red Hat Enterprise Linux systems, apply updates through the standard yum or dnf package managers once patches are released:

Workarounds

• Implement application-level input validation to filter CRLF characters from any user input before passing to libsoup header functions
• Use web application firewalls (WAF) to block requests containing CRLF sequences in sensitive parameters
• Consider using alternative HTTP libraries that perform proper header value sanitization
• Restrict or sandbox applications using libsoup to limit the impact of potential exploitation

# Check installed libsoup version on RHEL/Fedora systems
rpm -q libsoup

# Apply security updates when available
sudo dnf update libsoup --security

# For systems using yum
sudo yum update libsoup