VulnSocial

CVE-2026-3634Disclosure(gnome / enterprise_linux)

LOWCVSS 6.5 · MEDIUM

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in libsoup. An attacker controlling the value used to set the Content-Type header can inject a Carriage Return Line Feed (CRLF) sequence due to improper input sanitization in the `soup_message_headers_set_content_type()` function. This vulnerability allows for the injection of arbitrary header-value pairs, potentially leading to HTTP header injection and response splitting attacks.

gnome CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Exploit / PoC references
Vendor / third-party advisories
Weakness type (CWE)
CWE-93

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • enterprise_linux
  • libsoup

Threat summary

  • 3 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 3 classified signals
  • 3 total mentions across 1 day

Affected systems

Vendors
gnomeredhat
Products
enterprise_linuxlibsoup

6 versions affected across 2 products

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-03-17: 3Technical Details · 2026-03-17: 203-17
Signal classification1 categories
Disclosure
3100.0%
Referenced assets3 URLs
Full discourse3 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-3634 A flaw was found in libsoup. An attacker controlling the value used to set the Content-Type header can inject a Carriage Return Line Feed (CRLF) sequence due to imprope… https://www.cve.org/CVERecord?id=CVE-2026-3634

    Post summary

    The text announces a new CRLF injection vulnerability (CVE-2026-3634) in libsoup, noting that an attacker can control the Content‑Type header to inject CRLF sequences; no exploitation activity or remediation is mentioned.

    00010126
    56.8K followersView on X
  • CVEarity@CVEarity
    Disclosure

    ⚡ New CVE Alert: CVE-2026-3634 📊 Severity: 3.9 🚨 Risk Level: Low 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-3634 #CVE-2026-3634 #CVE #Low  #CyberSecurity #InfoSec https://t.co/CKI3CzkLKO

    Post summary

    The tweet merely announces CVE‑2026‑3634 with a low severity rating but provides no further technical or exploit details.

    0000030
    101 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-3634 HTTP Header Injection Vulnerability in libsoup via Content-Type Header Manipulation https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3634

    Post summary

    A brief disclosure identifies a header injection flaw in libsoup, triggered by manipulating the Content‑Type header.

    0000037
    4.0K followersView on X
CPE platform detail6 entries

6 of 6 entries

PartVendorProductVersionTarget SWTarget HW
Appgnomelibsoup---
OSredhatenterprise_linux10.0--
OSredhatenterprise_linux6.0--
OSredhatenterprise_linux7.0--
OSredhatenterprise_linux8.0--
OSredhatenterprise_linux9.0--

Explore more

Back to dashboardgnome CVEsredhat CVEsenterprise_linux vulnerabilities