CVE-2026-1467

The record

A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF (Carriage Return Line Feed) Injection, occurs when an HTTP proxy is configured and the library improperly handles URL-decoded input used to create the Host header. A remote attacker can exploit this by providing a specially crafted URL containing CRLF sequences, allowing them to inject additional HTTP headers or complete HTTP request bodies. This can lead to unintended or unauthorized HTTP requests being forwarded by the proxy, potentially impacting downstream services.

Affected packages

Related vulnerabilities

• CVE-2026-1760 A flaw was found in SoupServer. Also affects libsoup
• CVE-2026-1539 A flaw was found in the libsoup HTTP library that can cause proxy authentication… Also affects libsoup
• CVE-2024-52531 GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform… Also affects libsoup
• CVE-2024-52532 GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. Also affects libsoup
• CVE-2024-52530 GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because… Also affects libsoup
• CVE-2026-2708 A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. Also affects libsoup2
• CVE-2026-2369 A flaw was found in libsoup. Also affects libsoup2
• CVE-2026-2443 A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. Also affects libsoup2