CVE-2026-1536

Katalog CVE

CVSS 5.3 · Medium EPSS 0,35%

Kerentanan Improper Neutralization of CRLF Sequences ('CRLF Injection') pada gnome libsoup, redhat enterprise linux. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

A flaw was found in libsoup. An attacker who can control the input for the Content-Disposition header can inject CRLF (Carriage Return Line Feed) sequences into the header value. These sequences are then interpreted verbatim when the HTTP request or response is constructed, allowing arbitrary HTTP headers to be injected. This vulnerability can lead to HTTP header injection or HTTP response splitting without requiring authentication or user interaction.

Rincian

Terbit di NVD

28 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gitlab.gnome.org/GNOME/libsoup/-/issues/486 exploit · issue tracking · advisory vendor
• https://access.redhat.com/security/cve/CVE-2026-1536 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2433834 issue tracking · advisory pihak ketiga