PT-2026-5130 · Libsoup+2 · Libsoup+2

Osidb Bzimport · Published 2025-12-03 · Updated 2026-05-15 · CVE-2026-1536

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions libsoup (affected versions not specified)

Description A flaw exists in libsoup where an attacker controlling the input for the Content-Disposition header can inject CRLF (Carriage Return Line Feed) sequences into the header value. These sequences are interpreted when constructing HTTP requests or responses, potentially allowing arbitrary HTTP headers to be injected. This can lead to HTTP header injection or HTTP response splitting without authentication or user interaction. The vulnerable component is the handling of the Content-Disposition header.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-93

Related Identifiers

AZL-76370

AZL-76395

BDU:2026-04952

CVE-2026-1536

OESA-2026-2337

OESA-2026-2338

OESA-2026-2339

OPENSUSE-SU-2026:10139-1

OPENSUSE-SU-2026:20186-1

SUSE-SU-2026:0431-1

SUSE-SU-2026:0579-1

SUSE-SU-2026:20238-1

SUSE-SU-2026:20339-1

SUSE-SU-2026:20445-1

SUSE-SU-2026:20649-1

USN-8020-1

Affected Products

Linuxmint

Ubuntu

Libsoup

References · 68

• https://osv.dev/vulnerability/SUSE-SU-2026:20445-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2338 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-1536 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10139-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20339-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04952 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-32053 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-0716 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-1536 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-1539 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-1536 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8020-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-1536 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4945 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0431-1 · Vendor Advisory