{
  "document": {
    "aggregate_severity": {
      "text": "Medium"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/cloudlinux7els/vex/2026/cve-2026-1536-els_os-cloudlinux7els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-10-23T22:30:07Z",
      "generator": {
        "date": "2026-10-23T22:30:07Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2026-1536-ELS_OS-CLOUDLINUX7ELS",
      "initial_release_date": "2026-01-28T16:16:00Z",
      "revision_history": [
        {
          "date": "2026-01-28T16:16:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-23T22:30:07Z",
          "number": "2",
          "summary": "Official Publication"
        }
      ],
      "status": "final",
      "version": "2"
    },
    "title": "Security update on CVE-2026-1536"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "CloudLinux 7",
                "product": {
                  "name": "CloudLinux 7",
                  "product_id": "CloudLinux-7",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:cloudlinux:cloudlinux:7:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "CloudLinux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsoup-devel-0:2.62.2-2.0.13.el7.i686",
                "product": {
                  "name": "libsoup-devel-0:2.62.2-2.0.13.el7.i686",
                  "product_id": "libsoup-devel-0:2.62.2-2.0.13.el7.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libsoup-devel@2.62.2-2.0.13.el7?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-0:2.62.2-2.0.13.el7.i686",
                "product": {
                  "name": "libsoup-0:2.62.2-2.0.13.el7.i686",
                  "product_id": "libsoup-0:2.62.2-2.0.13.el7.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libsoup@2.62.2-2.0.13.el7?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsoup-devel-0:2.62.2-2.0.13.el7.x86_64",
                "product": {
                  "name": "libsoup-devel-0:2.62.2-2.0.13.el7.x86_64",
                  "product_id": "libsoup-devel-0:2.62.2-2.0.13.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libsoup-devel@2.62.2-2.0.13.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-0:2.62.2-2.0.13.el7.x86_64",
                "product": {
                  "name": "libsoup-0:2.62.2-2.0.13.el7.x86_64",
                  "product_id": "libsoup-0:2.62.2-2.0.13.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libsoup@2.62.2-2.0.13.el7?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Cloud Linux Software, Inc."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
                "product": {
                  "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
                  "product_id": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libsoup-devel@2.62.2-2.0.13.el7.tuxcare.els2?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
                "product": {
                  "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
                  "product_id": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libsoup@2.62.2-2.0.13.el7.tuxcare.els2?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
                "product": {
                  "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
                  "product_id": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libsoup-devel@2.62.2-2.0.13.el7.tuxcare.els2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
                "product": {
                  "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
                  "product_id": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libsoup@2.62.2-2.0.13.el7.tuxcare.els2?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "CloudLinux"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686"
        },
        "product_reference": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-devel-0:2.62.2-2.0.13.el7.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.i686"
        },
        "product_reference": "libsoup-devel-0:2.62.2-2.0.13.el7.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64"
        },
        "product_reference": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-devel-0:2.62.2-2.0.13.el7.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.x86_64"
        },
        "product_reference": "libsoup-devel-0:2.62.2-2.0.13.el7.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686"
        },
        "product_reference": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-0:2.62.2-2.0.13.el7.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.i686"
        },
        "product_reference": "libsoup-0:2.62.2-2.0.13.el7.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64"
        },
        "product_reference": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-0:2.62.2-2.0.13.el7.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.x86_64"
        },
        "product_reference": "libsoup-0:2.62.2-2.0.13.el7.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-1536",
      "cwe": {
        "id": "CWE-93",
        "name": "Improper Neutralization of CRLF Sequences ('CRLF Injection')"
      },
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libsoup. An attacker who can control the input for the Content-Disposition header can inject CRLF (Carriage Return Line Feed) sequences into the header value. These sequences are then interpreted verbatim when the HTTP request or response is constructed, allowing arbitrary HTTP headers to be injected. This vulnerability can lead to HTTP header injection or HTTP response splitting without requiring authentication or user interaction.",
          "title": "Vulnerability description"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.i686",
          "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
          "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
          "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.x86_64",
          "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.i686",
          "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
          "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
          "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-1536"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/security/cve/CVE-2026-1536",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1536"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2433834",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433834"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/486",
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/486"
        }
      ],
      "release_date": "2026-01-28T16:16:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "date": "2026-10-15T15:18:35.184526Z",
          "details": "This flaw is only reachable if an application using libsoup constructs an HTTP request or response that sets the Content-Disposition header directly from attacker‑controlled input (for example by calling the header‑setter with untrusted data), which is a non‑default usage pattern. Even when reachable, the effect is limited to header injection/response splitting with no confidentiality or availability impact, and standard server behavior does not derive Content‑Disposition from client input while libsoup’s multipart/form‑data APIs handle this header internally. Given these narrow preconditions and limited impact, it is reasonable to deprioritize this CVE in centrally managed enterprise VM/server deployments.",
          "product_ids": [
            "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.i686",
            "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
            "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
            "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.x86_64",
            "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.i686",
            "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
            "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
            "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.i686",
            "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
            "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
            "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.x86_64",
            "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.i686",
            "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686",
            "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64",
            "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    }
  ]
}