A flaw in libsoup allows an attacker who can supply the method argument to the soup_message_new() function to inject arbitrary HTTP headers and additional request data through CRLF injection. The method value is not escaped during request line construction, enabling header and request line manipulation. This can lead to unintended request behavior, possible request smuggling, or other attack vectors that alter the semantics of HTTP traffic, raising integrity and availability concerns.

The vulnerability affects the Libsoup library on Red Hat Enterprise Linux 6 through 10. Any installation of libsoup on those platforms, including its derivatives that incorporate the library, is potentially impacted.

The CVSS score is 3.9, indicating low severity, and the EPSS score is below 1%, suggesting a very low probability of exploitation. It is not listed in the CISA KEV catalog. Nevertheless, the attack vector is remote: an adversary can exploit the flaw via network traffic that goes through an application using the vulnerable libsoup library. No active exploitation is currently documented, but the availability of an injection point means that an attacker could craft malicious requests to influence application behavior.