CVE detail
CVE-2026-3632
A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not properly validate hostnames, allowing special characters to be injected into HTTP headers. A remote attacker could exploit this to perform HTTP smuggling, where they can send hidden, malicious requests alongside legitimate ones. In certain situations, this could lead to Server-Side Request Forgery (SSRF), enabling an attacker to force the server to make unauthorized requests to other internal or external systems. The impact is low, as SoupServer is not actually used in internet infrastructure.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 16.1 · diversity 16.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
4 source links · newest first
- CVE-2026-3632 Libsoup: libsoup: http smuggling and server-side request forgery via malformed hostnamesMicrosoft MSRC
Information published.
vendormsrc.microsoft.comJun 28, 2026, 9:01 AM - https://gitlab.gnome.org/GNOME/libsoup/-/issues/483gitlab.gnome.org
No excerpt available.
Exploitgitlab.gnome.orgMar 17, 2026, 10:16 AM - https://bugzilla.redhat.com/show_bug.cgi?id=2445127bugzilla.redhat.com
No excerpt available.
Exploitbugzilla.redhat.comMar 17, 2026, 10:16 AM - https://access.redhat.com/security/cve/CVE-2026-3632access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 17, 2026, 10:16 AM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-12549CVSS 4.8 · Medium
The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request…
- CVE-2026-2708CVSS 3.7 · Low
A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditiona…
- CVE-2026-5119CVSS 5.9 · Medium
A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNEC…
- CVE-2026-2436CVSS 6.5 · Medium
A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects pre…
- CVE-2026-4271CVSS 5.3 · Medium
A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can…
- CVE-2026-3634CVSS 3.9 · Low
A flaw was found in libsoup. An attacker controlling the value used to set the Content-Type header can inject a Carriage Return Line Feed (CRLF) sequence due to improper input san…