CVE-2026-1536

MediumCVSS 5.3/10Last modified Nov 5, 2026

Description

A flaw was found in libsoup. An attacker who can control the input for the Content-Disposition header can inject CRLF (Carriage Return Line Feed) sequences into the header value. These sequences are then interpreted verbatim when the HTTP request or response is constructed, allowing arbitrary HTTP headers to be injected. This vulnerability can lead to HTTP header injection or HTTP response splitting without requiring authentication or user interaction.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-93

Affected software

Vendor	Product	Versions
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—

References

https://access.redhat.com/security/cve/CVE-2026-1536Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2433834Issue Tracking, Third Party Advisory
https://gitlab.gnome.org/GNOME/libsoup/-/issues/486Exploit, Issue Tracking, Vendor Advisory

Timeline

Published: Jan 28, 2026
Last modified: Nov 5, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-153609.1The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing CVE-2026-153618.1The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise CVE-2026-153652.4A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app.CVE-2026-153662.4A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page CVE-2026-153688.1The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to th CVE-2026-153699.8The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and includ CVE-2026-15375.3The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to unauthorized access of data due to CVE-2026-153707.3A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-s CVE-2026-153718.1Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be CVE-2026-153727.5The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected a CVE-2026-153736.3A vulnerability was detected in Eleveo Call Recording Software 9.7.0. The impacted element is an unknown function of the file /callrec/userA CVE-2026-153746.3A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown function of the file /callrec/roleAddAction.do of the