PT-2026-25888 · Libsoup · Libsoup

Published 2026-01-01 · Updated 2026-03-17 · CVE-2026-3632

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libsoup (affected versions not specified)

Description libsoup, a library used by applications to send network requests, does not properly validate hostnames, allowing special characters to be injected into HTTP headers. This can be exploited to perform HTTP smuggling, where malicious requests are sent alongside legitimate ones. In certain situations, this could lead to Server-Side Request Forgery (SSRF), enabling an attacker to force the server to make unauthorized requests to other internal or external systems. The impact is considered low, as SoupServer is not widely used in internet infrastructure. The issue involves a CRLF injection in the hostname, leading to request smuggling via URL.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1286

Related Identifiers

BDU:2026-04972

CVE-2026-3632

ECHO-CD7E-C6BA-0346

Affected Products

Libsoup

References · 15

• https://gitlab.gnome.org/GNOME/libsoup/-/issues/483 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-3632 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-3632 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04972 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-3632 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2445127 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2026-3632 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-3632 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3632 · Security Note
• https://ubuntu.com/security/CVE-2026-3632 · Vendor Advisory
• https://access.redhat.com/security/cve/cve-2026-3632 · Note
• https://twitter.com/VulmonFeeds/status/2033858553690165503 · Twitter Post
• https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=ecfaae031cf3c0517dc347dffe066b36 · Note
• https://twitter.com/CVEarity/status/2033955723797987412 · Twitter Post
• https://twitter.com/CVEnew/status/2033994285763469457 · Twitter Post