Bug 2433174 (CVE-2026-1467)

Summary: CVE-2026-1467 libsoup: libsoup: HTTP header injection via specially crafted URLs when an HTTP proxy is configured
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF (Carriage Return Line Feed) Injection, occurs when an HTTP proxy is configured and the library improperly handles URL-decoded input used to create the Host header. A remote attacker can exploit this by providing a specially crafted URL containing CRLF sequences, allowing them to inject additional HTTP headers or complete HTTP request bodies. This can lead to unintended or unauthorized HTTP requests being forwarded by the proxy, potentially impacting downstream services.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2433176, 2433178, 2433179, 2433181, 2433177, 2433180    
Bug Blocks:    

Description OSIDB Bzimport 2026-01-27 08:13:34 UTC 
CRLF Injection vulnerability in the libsoup HTTP client library when an HTTP proxy is configured. The issue is caused by improper sanitization of URL-decoded input used to populate the Host header during request creation in the SoupSession workflow. By supplying a specially crafted URL containing CRLF sequences, an attacker can inject additional HTTP headers or complete HTTP request bodies. Exploitation requires a victim application to process an attacker-controlled URL while using an HTTP proxy. Successful exploitation may allow unintended or unauthorized HTTP requests to be forwarded by the proxy, potentially impacting downstream services, but does not directly compromise the client system.