CVE-2026-3632

Katalog CVE

CVSS 5.5 · Medium EPSS 0,35%

Kerentanan Improper Validation of Syntactic Correctness of Input pada gnome libsoup, redhat enterprise linux. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not properly validate hostnames, allowing special characters to be injected into HTTP headers. A remote attacker could exploit this to perform HTTP smuggling, where they can send hidden, malicious requests alongside legitimate ones. In certain situations, this could lead to Server-Side Request Forgery (SSRF), enabling an attacker to force the server to make unauthorized requests to other internal or external systems. The impact is low, as SoupServer is not actually used in internet infrastructure.

Rincian

Terbit di NVD

17 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1286: Improper Validation of Syntactic Correctness of Input

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-3632 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2445127 issue tracking · advisory vendor
• https://gitlab.gnome.org/GNOME/libsoup/-/issues/483 exploit · issue tracking · advisory vendor