{"id":"CVE-2026-3632","aliases":[],"cve":{"records":[{"id":"CVE-2026-3632","source":"redhat","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-03-06T07:51:17.978Z","published":"2026-03-17T09:44:19.758Z","modified":"2026-11-06T18:37:57.900Z"}],"publishers":[{"name":"redhat","role":"CNA","organizationId":"53f830b8-0a3f-465b-8143-3b8a9948e749","modified":"2026-11-06T18:37:57.900Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-03-17T13:02:07.183Z"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-3632","tags":["vdb-entry","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445127","tags":["issue-tracking","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://gitlab.gnome.org/GNOME/libsoup/-/issues/483","tags":[],"source":"redhat"}],"weaknesses":[{"id":"CWE-1286","description":"Improper Validation of Syntactic Correctness of Input","source":"redhat"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-03-17T13:01:56.752811Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Libsoup: libsoup: http smuggling and server-side request forgery via malformed hostnames","titleSource":"redhat","descriptionSource":"redhat","description":"A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not properly validate hostnames, allowing special characters to be injected into HTTP headers. A remote attacker could exploit this to perform HTTP smuggling, where they can send hidden, malicious requests alongside legitimate ones. In certain situations, this could lead to Server-Side Request Forgery (SSRF), enabling an attacker to force the server to make unauthorized requests to other internal or external systems. The impact is low, as SoupServer is not actually used in internet infrastructure.","score":3.9,"severity":"low","published":"2026-03-17T09:44:19.758Z","modified":"2026-11-06T18:37:57.900Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 10","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux:10"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-3632"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 6","platforms":[],"versions":[],"defaultStatus":"unknown","cpes":["cpe:/o:redhat:rhel_els:6"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-3632"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 7","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/o:redhat:rhel_els:7"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-3632"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 8","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux:8"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-3632"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux:9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-3632"}],"remediation":[{"text":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-3632"}],"references":["https://access.redhat.com/security/cve/CVE-2026-3632","https://bugzilla.redhat.com/show_bug.cgi?id=2445127","https://gitlab.gnome.org/GNOME/libsoup/-/issues/483"],"sources":[{"name":"CVE","id":"CVE-2026-3632","modified":"2026-11-06T18:37:57.900Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-3632"}],"assessments":[{"source":"redhat","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","score":3.9}],"sourceAffected":[],"observedAt":"2026-11-06T19:35:23.067Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:00:33.565Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-07T00:35:34.446Z","attemptedAt":"2026-11-07T00:35:34.446Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-07T00:35:34.785Z","attemptedAt":"2026-11-07T00:35:34.785Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-07T00:35:34.905Z","attemptedAt":"2026-11-07T00:35:34.905Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-07T00:35:34.332Z","attemptedAt":"2026-11-07T00:35:34.332Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-3632","url":"https://www.first.org/epss/","probability":0.0022,"percentile":0.12627,"date":"2026-11-06","checkedAt":"2026-11-07T00:35:34.332Z"},{"source":"NVD","id":"CVE-2026-3632","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3632","modified":"2026-11-06T19:17:50.120","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","checkedAt":"2026-11-07T00:35:34.446Z"},{"source":"NVD","id":"CVE-2026-3632","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3632","modified":"2026-11-06T19:17:50.120","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","checkedAt":"2026-11-07T00:35:34.446Z"},{"source":"GitHub Advisory Database","id":"GHSA-v5mp-vx4p-jwp6","url":"https://github.com/advisories/GHSA-v5mp-vx4p-jwp6","modified":"2026-03-17T12:30:20Z","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","checkedAt":"2026-11-07T00:35:34.785Z"},{"source":"ENISA EUVD","id":"EUVD-2026-12559","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12559","modified":"Nov 6, 2026, 6:37:57 PM","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","checkedAt":"2026-11-07T00:35:34.905Z"}],"aiSummary":{"text":"A flaw in libsoup allows HTTP smuggling and server-side request forgery via malformed hostnames, potentially leading to unauthorized requests. The impact is low. A remote attacker could exploit this by injecting special characters into HTTP headers.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-06T19:46:14.298Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-3632"}]}}