{ "document": { "aggregate_severity": { "text": "Medium" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/cloudlinux7els/vex/2026/cve-2026-1467-els_os-cloudlinux7els.json" } ], "tracking": { "current_release_date": "2026-10-23T22:30:07Z", "generator": { "date": "2026-10-23T22:30:07Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2026-1467-ELS_OS-CLOUDLINUX7ELS", "initial_release_date": "2026-01-27T10:15:00Z", "revision_history": [ { "date": "2026-01-27T10:15:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-10-23T22:30:07Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Security update on CVE-2026-1467" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "CloudLinux 7", "product": { "name": "CloudLinux 7", "product_id": "CloudLinux-7", "product_identification_helper": { "cpe": "cpe:2.3:o:cloudlinux:cloudlinux:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "CloudLinux" }, { "branches": [ { "category": "product_version", "name": "libsoup-devel-0:2.62.2-2.0.13.el7.i686", "product": { "name": "libsoup-devel-0:2.62.2-2.0.13.el7.i686", "product_id": "libsoup-devel-0:2.62.2-2.0.13.el7.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libsoup-devel@2.62.2-2.0.13.el7?arch=i686" } } }, { "category": "product_version", "name": "libsoup-0:2.62.2-2.0.13.el7.i686", "product": { "name": "libsoup-0:2.62.2-2.0.13.el7.i686", "product_id": "libsoup-0:2.62.2-2.0.13.el7.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libsoup@2.62.2-2.0.13.el7?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "libsoup-devel-0:2.62.2-2.0.13.el7.x86_64", "product": { "name": "libsoup-devel-0:2.62.2-2.0.13.el7.x86_64", "product_id": "libsoup-devel-0:2.62.2-2.0.13.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libsoup-devel@2.62.2-2.0.13.el7?arch=x86_64" } } }, { "category": "product_version", "name": "libsoup-0:2.62.2-2.0.13.el7.x86_64", "product": { "name": "libsoup-0:2.62.2-2.0.13.el7.x86_64", "product_id": "libsoup-0:2.62.2-2.0.13.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libsoup@2.62.2-2.0.13.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Cloud Linux Software, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "product": { "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "product_id": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libsoup-devel@2.62.2-2.0.13.el7.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "product": { "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "product_id": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libsoup@2.62.2-2.0.13.el7.tuxcare.els2?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "product": { "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "product_id": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libsoup-devel@2.62.2-2.0.13.el7.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "product": { "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "product_id": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libsoup@2.62.2-2.0.13.el7.tuxcare.els2?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686" }, "product_reference": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libsoup-devel-0:2.62.2-2.0.13.el7.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.i686" }, "product_reference": "libsoup-devel-0:2.62.2-2.0.13.el7.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64" }, "product_reference": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libsoup-devel-0:2.62.2-2.0.13.el7.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.x86_64" }, "product_reference": "libsoup-devel-0:2.62.2-2.0.13.el7.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686" }, "product_reference": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libsoup-0:2.62.2-2.0.13.el7.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.i686" }, "product_reference": "libsoup-0:2.62.2-2.0.13.el7.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64" }, "product_reference": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libsoup-0:2.62.2-2.0.13.el7.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.x86_64" }, "product_reference": "libsoup-0:2.62.2-2.0.13.el7.x86_64", "relates_to_product_reference": "CloudLinux-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-1467", "cwe": { "id": "CWE-93", "name": "Improper Neutralization of CRLF Sequences ('CRLF Injection')" }, "notes": [ { "category": "description", "text": "A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF (Carriage Return Line Feed) Injection, occurs when an HTTP proxy is configured and the library improperly handles URL-decoded input used to create the Host header. A remote attacker can exploit this by providing a specially crafted URL containing CRLF sequences, allowing them to inject additional HTTP headers or complete HTTP request bodies. This can lead to unintended or unauthorized HTTP requests being forwarded by the proxy, potentially impacting downstream services.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.i686", "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.x86_64", "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.i686", "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-1467" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-1467", "url": "https://access.redhat.com/security/cve/CVE-2026-1467" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2433174", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433174" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/488", "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/488" } ], "release_date": "2026-01-27T10:15:00Z", "remediations": [ { "category": "no_fix_planned", "date": "2026-10-15T15:18:35.018505Z", "details": "This flaw only triggers when two specific preconditions are met: an explicit HTTP proxy is configured and the application builds outbound requests from attacker-supplied, URL-decoded input such that libsoup derives the Host header from it; without both, there is no injection path. The impact is limited to tampering with outbound requests (header/body injection) and does not provide code execution, data disclosure, or service outage. In centrally managed VM/server deployments that do not route HTTP through a proxy or do not accept untrusted URLs for outbound requests, practical exploitability is negligible, so this can be safely deprioritized.", "product_ids": [ "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.i686", "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.x86_64", "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.i686", "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.i686", "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.x86_64", "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.i686", "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }