CRLF Injection vulnerability in the libsoup HTTP client library when an HTTP proxy is configured. The issue is caused by improper sanitization of URL-decoded input used to populate the Host header during request creation in the SoupSession workflow. By supplying a specially crafted URL containing CRLF sequences, an attacker can inject additional HTTP headers or complete HTTP request bodies. Exploitation requires a victim application to process an attacker-controlled URL while using an HTTP proxy. Successful exploitation may allow unintended or unauthorized HTTP requests to be forwarded by the proxy, potentially impacting downstream services, but does not directly compromise the client system.