Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
6 versions affected across 2 products
| Date | Total | Labels |
|---|
| 2026-03-17 | 4 | Disclosure2General1Patch1 |
| 2026-03-23 | 1 | Disclosure1 |
🚨 CVE-2026-3633: Remote CRLF injection in GNOME libsoup lets attackers slip arbitrary headers into your HTTP requests. Patch or sanitize method values to shut it down. Full advisory ➡️ https://volerion.com/vulnerabilities/CVE-2026-3633 #infosec #Linux #AppSec
Post summary
The advisory reports a CRLF injection flaw (CVE‑2026‑3633) in GNOME libsoup and recommends applying a patch or sanitizing HTTP method values.
🚨 Another day, another “just a method string” that turns into header smuggling. If your HTTP parsing is this trusting, Windows devs are gonna blame Windows… like it’s a driver problem. https://windowsforum.com/threads/cve-2026-3633-libsoup-crlf-injection-method-header-smuggling-risk.406527/ #CrlfInjection #HttpRequestSmuggling #Libsoup #Cve20263633 https://t.co/gUaGxvcPgL
Post summary
The tweet warns of a new CVE (CVE‑2026‑3633) involving CRLF injection and HTTP request smuggling in Libsoup, linking to a forum thread for discussion.
CVE-2026-3633 A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional … https://www.cve.org/CVERecord?id=CVE-2026-3633
Post summary
The post announces that CVE‑2026‑3633 is a flaw in libsoup, enabling remote header injection via the method parameter of `soup_message_new()`. No PoC, exploit, patch, or exploitation evidence is provided.
⚡ New CVE Alert: CVE-2026-3633 📊 Severity: 3.9 🚨 Risk Level: Low 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-3633 #CVE-2026-3633 #CVE #Low #CyberSecurity #InfoSec https://t.co/Gj9qS8q1dn
Post summary
The tweet announces a new CVE (CVE-2026-3633) with basic severity information and a reference link, but offers no technical details, exploitation evidence, or mitigation guidance.
CVE-2026-3633 CRLF Injection Vulnerability in libsoup HTTP Request Header Processing https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3633
Post summary
The content announces CVE‑2026‑3633 as a CRLF injection flaw in libsoup, but offers neither PoC nor exploitation details, patches, or evidence of active use.
6 of 6 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | gnome | libsoup | - | - | - |
| OS | redhat | enterprise_linux | 10.0 | - | - |
| OS | redhat | enterprise_linux | 6.0 | - | - |
| OS | redhat | enterprise_linux | 7.0 | - | - |
| OS | redhat | enterprise_linux | 8.0 | - | - |
| OS | redhat | enterprise_linux | 9.0 | - | - |