libsoup, the HTTP client and server library used by a variety of Linux applications, contains a flaw that permits an attacker capable of controlling the Content-Disposition header to embed CRLF (Carriage Return Line Feed) sequences. Those sequences are interpreted literally when the HTTP request or response is assembled, effectively allowing the attacker to inject arbitrary HTTP headers. This vulnerability can lead to HTTP header injection and HTTP response splitting without requiring authentication or user interaction.

The affected software is distributed with Red Hat Enterprise Linux 6, 7, 8, 9 and 10, as well as with the GNOME libsoup library on other operating systems. No specific version ranges are listed, so any installation that includes the vulnerable libsoup code remains affected until a fix is applied.

The CVSS v3.1 score of 5.8 indicates a medium severity issue, while the EPSS score of less than 1 % suggests a very low probability of automated exploitation presently. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be network‑based because the attacker only needs to supply a malicious Content‑Disposition header in a request or response; no authentication or prior user interaction is required. Exploitation would involve transmitting a crafted header that contains CRLF sequences, which a server or client using the vulnerable libsoup implementation will accept unfiltered.