CVE-2026-3632

CVE-2026-3632 is a low-severity vulnerability in Redhat Enterprise Linux with a CVSS 3.x base score of 3.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1286.

Key facts

Description

A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not properly validate hostnames, allowing special characters to be injected into HTTP headers. A remote attacker could exploit this to perform HTTP smuggling, where they can send hidden, malicious requests alongside legitimate ones. In certain situations, this could lead to Server-Side Request Forgery (SSRF), enabling an attacker to force the server to make unauthorized requests to other internal or external systems. The impact is low, as SoupServer is not actually used in internet infrastructure.

Frequently asked questions

What is CVE-2026-3632?
A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not properly validate hostnames, allowing special characters to be injected into HTTP headers. A remote attacker could exploit this to perform HTTP smuggling, where they can send hidden, malicious requests alongside legitimate ones. In certain situations, this could lead to Server-Side Request Forgery (SSRF), enabling an attacker to force the server to make unauthorized requests to other internal or external systems. The impact is low, as SoupServer is not actually used in internet infrastructure.
How severe is CVE-2026-3632?
CVE-2026-3632 has a CVSS 3.x base score of 3.9, rated low severity. It is exploitable over network with high attack complexity, requires high privileges and user interaction. Impact on confidentiality is low, integrity low, and availability low.
Is CVE-2026-3632 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (11th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-3632?
CVE-2026-3632 primarily affects Redhat Enterprise Linux. In total, 6 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2026-3632?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-3632 have an EU (EUVD) identifier?
Yes. CVE-2026-3632 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-12559.
When was CVE-2026-3632 published?
CVE-2026-3632 was published on 2026-03-17 and last updated on 2026-06-17.

References

Affected products (6)

More vulnerabilities in Redhat Enterprise Linux

All CVEs affecting Redhat Enterprise Linux →

Other CWE-1286 vulnerabilities

Browse all CWE-1286 vulnerabilities →