CVE catalog

CVE-2026-3632

A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not properly validate hostnames, allowing special characters to be

[CVE catalog]

Severity: Low · CVSS 3.9CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L
Published: Mar 6, 2026, 5:05:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.21% · Oct 25, 2026

A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not properly validate hostnames, allowing special characters to be injected into HTTP headers. A remote attacker could exploit this to perform HTTP smuggling, where they can send hidden, malicious requests alongside legitimate ones. In certain situations, this could lead to Server-Side Request Forgery (SSRF), enabling an attacker to force the server to make unauthorized requests to other internal or external systems. The impact is low, as SoupServer is not actually used in internet infrastructure.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libsoup3	sid	`3.8.0-3`	vulnerable
Debian	libsoup3	forky	`3.8.0-3`	vulnerable
Debian	libsoup3	trixie	`3.6.5-3`	vulnerable
Debian	libsoup3	bookworm	`3.2.3-0+deb12u2`	vulnerable
Debian	libsoup2.4	trixie	`2.74.3-10.1`	vulnerable
Debian	libsoup2.4	bookworm	`2.74.3-1+deb12u1`	vulnerable
Cpe	libsoup2.4	Not reported	Not reported	vulnerable
Cpe	libsoup3	Not reported	Not reported	vulnerable
Ubuntu	libsoup2.4	pro	`2.74.3-10.1ubuntu4`	vulnerable
Ubuntu	libsoup2.4	pro	`2.74.3-10.1ubuntu5`	vulnerable
Ubuntu	libsoup2.4	pro	`2.74.3-10.1ubuntu5+esm1`	vulnerable
Ubuntu	libsoup2.4	pro	`2.74.3-10.1ubuntu5+esm2`	vulnerable
Ubuntu	libsoup2.4	pro	`2.74.3-10.1ubuntu5+esm3`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.72.0-3ubuntu3`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.1-1`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-2`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.1`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.2`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.3`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.4`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.5`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.6`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.7`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.8`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.9`	vulnerable
Ubuntu	libsoup3	pro	`3.0.4-2`	vulnerable
Ubuntu	libsoup3	pro	`3.0.4-3`	vulnerable
Ubuntu	libsoup3	pro	`3.0.5-1`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1+esm1`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1+esm2`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1+esm3`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1+esm4`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1+esm5`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1+esm6`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1+esm7`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1+esm8`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1+esm9`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-1`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-2`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-3`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6build1`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.1`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.2`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.3`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.4`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.5`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.6`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.7`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.8`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.9`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.2-4`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-1`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-2`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-4`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5build1`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5build2`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5ubuntu0.1`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5ubuntu0.2`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5ubuntu0.3`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5ubuntu0.4`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5ubuntu0.5`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5ubuntu0.6`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5ubuntu0.7`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5ubuntu0.8`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5ubuntu0.9`	vulnerable
Ubuntu	libsoup2.4	25.10	`2.74.3-10`	vulnerable
Ubuntu	libsoup2.4	25.10	`2.74.3-10.1`	vulnerable
Ubuntu	libsoup2.4	25.10	`2.74.3-10.1ubuntu1`	vulnerable
Ubuntu	libsoup2.4	25.10	`2.74.3-10.1ubuntu2`	vulnerable
Ubuntu	libsoup2.4	25.10	`2.74.3-10.1ubuntu3`	vulnerable
Ubuntu	libsoup2.4	25.10	`2.74.3-10.1ubuntu4`	vulnerable
Ubuntu	libsoup2.4	25.10	`2.74.3-10.1ubuntu4.1`	vulnerable
Ubuntu	libsoup3	25.10	`3.6.5-1`	vulnerable
Ubuntu	libsoup3	25.10	`3.6.5-1ubuntu1`	vulnerable
Ubuntu	libsoup3	25.10	`3.6.5-3`	vulnerable
Ubuntu	libsoup3	25.10	`3.6.5-4`	vulnerable
Ubuntu	libsoup3	25.10	`3.6.5-4ubuntu0.1`	vulnerable
Ubuntu	libsoup3	25.10	`3.6.5-4ubuntu0.2`	vulnerable
Ubuntu	libsoup2.4	26.10	`2.74.3-10.1ubuntu5`	vulnerable
Ubuntu	libsoup3	26.10	`3.6.6-1`	vulnerable
Ubuntu	libsoup3	26.10	`3.6.6-1ubuntu3`	vulnerable
Ubuntu	libsoup3	26.04	`3.6.5-4`	vulnerable
Ubuntu	libsoup3	26.04	`3.6.5-5`	vulnerable
Ubuntu	libsoup3	26.04	`3.6.5-6`	vulnerable
Ubuntu	libsoup3	26.04	`3.6.5-7`	vulnerable
Ubuntu	libsoup3	26.04	`3.6.5-9`	vulnerable
Ubuntu	libsoup3	26.04	`3.6.6-1`	vulnerable
Ubuntu	libsoup3	26.04	`3.6.6-1ubuntu0.1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libsoup3	source	sid	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	libsoup3	source	forky	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	libsoup3	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	libsoup3	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	libsoup2.4	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	libsoup2.4	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported

Notes

[trixie] libsoup3: Minor issue [bookworm] libsoup3: Minor issue [trixie] libsoup2.4: Minor issue [bookworm] libsoup2.4: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[gir1.2-soup-2.4]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
[gir1.2-soup-3.0]Affected
Source package: [libsoup3]
Details (2)
- 3.2.3-0+deb12u2 · amd64 · bookworm
  Affected
  nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12
- 3.2.3-0+deb12u2 · arm64 · bookworm
  Affected
  nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12
[libsoup2.4-1]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
[libsoup2.4-common]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · all · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · all · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
[libsoup2.4-dev]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
[libsoup2.4-doc]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · all · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · all · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
[libsoup2.4-tests]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
[libsoup-3.0-0]Affected
Source package: [libsoup3]
Details (2)
- 3.2.3-0+deb12u2 · amd64 · bookworm
  Affected
  nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12
- 3.2.3-0+deb12u2 · arm64 · bookworm
  Affected
  nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12
[libsoup-3.0-common]Affected
Source package: [libsoup3]
Details (2)
- 3.2.3-0+deb12u2 · all · bookworm
  Affected
  nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12
- 3.2.3-0+deb12u2 · all · bookworm
  Affected
  nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12
[libsoup-3.0-dev]Affected
Source package: [libsoup3]
Details (2)
- 3.2.3-0+deb12u2 · amd64 · bookworm
  Affected
  nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12
- 3.2.3-0+deb12u2 · arm64 · bookworm
  Affected
  nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12
[libsoup-3.0-doc]Affected
Source package: [libsoup3]
Details (2)
- 3.2.3-0+deb12u2 · all · bookworm
  Affected
  nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12
- 3.2.3-0+deb12u2 · all · bookworm
  Affected
  nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12
[libsoup-3.0-tests]Affected
Source package: [libsoup3]
Details (2)
- 3.2.3-0+deb12u2 · amd64 · bookworm
  Affected
  nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12
- 3.2.3-0+deb12u2 · arm64 · bookworm
  Affected
  nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12
[libsoup-gnome2.4-1]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
[libsoup-gnome2.4-dev]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

[Debian 13 (Trixie)]

[gir1.2-soup-2.4]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-10.1 · amd64 · trixie
  Affected
  nvd · libsoup2.4 · debian · 13
- 2.74.3-10.1 · arm64 · trixie
  Affected
  nvd · libsoup2.4 · debian · 13
[gir1.2-soup-3.0]Affected
Source package: [libsoup3]
Details (2)
- 3.6.5-3 · amd64 · trixie
  Affected
  nvd · libsoup3 · debian · 13
- 3.6.5-3 · arm64 · trixie
  Affected
  nvd · libsoup3 · debian · 13
[libsoup-2.4-1]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-10.1 · amd64 · trixie
  Affected
  nvd · libsoup2.4 · debian · 13
- 2.74.3-10.1 · arm64 · trixie
  Affected
  nvd · libsoup2.4 · debian · 13
[libsoup2.4-common]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-10.1 · all · trixie
  Affected
  nvd · libsoup2.4 · debian · 13
- 2.74.3-10.1 · all · trixie
  Affected
  nvd · libsoup2.4 · debian · 13
[libsoup2.4-dev]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-10.1 · amd64 · trixie
  Affected
  nvd · libsoup2.4 · debian · 13
- 2.74.3-10.1 · arm64 · trixie
  Affected
  nvd · libsoup2.4 · debian · 13
[libsoup2.4-doc]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-10.1 · all · trixie
  Affected
  nvd · libsoup2.4 · debian · 13
- 2.74.3-10.1 · all · trixie
  Affected
  nvd · libsoup2.4 · debian · 13

Next results

Observed: Oct 23, 2026, 10:42:01 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]