The flaw resides in the libsoup HTTP client library, where URL‑decoded data is used to build the Host header without proper CRLF sanitization. A maliciously crafted URL that contains carriage return and line feed characters can inject arbitrary HTTP headers or request bodies into the request sent by the proxy. As a result, an attacker can trick the proxy into sending unauthorized or malformed traffic to backend services, potentially enabling unauthorized operations or leaking sensitive data. The vulnerability is identified as CWE‑93, a weakness in input sanitization.

Red Hat Enterprise Linux distribution versions 6, 7, 8, 9 and 10 are affected through the underlying libsoup component. Exact library version numbers are not disclosed, and no minimal or maximal affected versions are listed by the vendor. The vulnerability applies to any configuration where apps built on libsoup use an HTTP proxy.

The CVSS score of 5.8 indicates a medium severity impact. The EPSS probability of under 1% suggests that exploitation is unlikely at the current time, and the vulnerability is not among CISA's Known Exploited Vulnerabilities. The attack requires network access to the proxy and the ability to inject a specially crafted URL into a libsoup‑handled request. If an attacker can supply such a URL—either directly to an application or through a web service—then the proxy may forward forged requests to downstream hosts, potentially affecting confidentiality, integrity, or availability of those services.