{ "document": { "aggregate_severity": { "text": "Medium" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/cloudlinux7els/vex/2026/cve-2026-3632-els_os-cloudlinux7els.json" } ], "tracking": { "current_release_date": "2026-10-23T22:30:07Z", "generator": { "date": "2026-10-23T22:30:07Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2026-3632-ELS_OS-CLOUDLINUX7ELS", "initial_release_date": "2026-03-17T10:16:00Z", "revision_history": [ { "date": "2026-03-17T10:16:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-10-23T22:30:07Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Security update on CVE-2026-3632" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "CloudLinux 7", "product": { "name": "CloudLinux 7", "product_id": "CloudLinux-7", "product_identification_helper": { "cpe": "cpe:2.3:o:cloudlinux:cloudlinux:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "CloudLinux" }, { "branches": [ { "category": "product_version", "name": "libsoup-devel-0:2.62.2-2.0.13.el7.i686", "product": { "name": "libsoup-devel-0:2.62.2-2.0.13.el7.i686", "product_id": "libsoup-devel-0:2.62.2-2.0.13.el7.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libsoup-devel@2.62.2-2.0.13.el7?arch=i686" } } }, { "category": "product_version", "name": "libsoup-0:2.62.2-2.0.13.el7.i686", "product": { "name": "libsoup-0:2.62.2-2.0.13.el7.i686", "product_id": "libsoup-0:2.62.2-2.0.13.el7.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libsoup@2.62.2-2.0.13.el7?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "libsoup-devel-0:2.62.2-2.0.13.el7.x86_64", "product": { "name": "libsoup-devel-0:2.62.2-2.0.13.el7.x86_64", "product_id": "libsoup-devel-0:2.62.2-2.0.13.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libsoup-devel@2.62.2-2.0.13.el7?arch=x86_64" } } }, { "category": "product_version", "name": "libsoup-0:2.62.2-2.0.13.el7.x86_64", "product": { "name": "libsoup-0:2.62.2-2.0.13.el7.x86_64", "product_id": "libsoup-0:2.62.2-2.0.13.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libsoup@2.62.2-2.0.13.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Cloud Linux Software, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "product": { "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "product_id": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libsoup-devel@2.62.2-2.0.13.el7.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "product": { "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "product_id": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libsoup@2.62.2-2.0.13.el7.tuxcare.els2?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "product": { "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "product_id": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libsoup-devel@2.62.2-2.0.13.el7.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "product": { "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "product_id": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libsoup@2.62.2-2.0.13.el7.tuxcare.els2?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686" }, "product_reference": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libsoup-devel-0:2.62.2-2.0.13.el7.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.i686" }, "product_reference": "libsoup-devel-0:2.62.2-2.0.13.el7.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64" }, "product_reference": "libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libsoup-devel-0:2.62.2-2.0.13.el7.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.x86_64" }, "product_reference": "libsoup-devel-0:2.62.2-2.0.13.el7.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686" }, "product_reference": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libsoup-0:2.62.2-2.0.13.el7.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.i686" }, "product_reference": "libsoup-0:2.62.2-2.0.13.el7.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64" }, "product_reference": "libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "libsoup-0:2.62.2-2.0.13.el7.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.x86_64" }, "product_reference": "libsoup-0:2.62.2-2.0.13.el7.x86_64", "relates_to_product_reference": "CloudLinux-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-3632", "cwe": { "id": "CWE-1286", "name": "Improper Validation of Syntactic Correctness of Input" }, "notes": [ { "category": "description", "text": "A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not properly validate hostnames, allowing special characters to be injected into HTTP headers. A remote attacker could exploit this to perform HTTP smuggling, where they can send hidden, malicious requests alongside legitimate ones. In certain situations, this could lead to Server-Side Request Forgery (SSRF), enabling an attacker to force the server to make unauthorized requests to other internal or external systems. The impact is low, as SoupServer is not actually used in internet infrastructure.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.i686", "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.x86_64", "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.i686", "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-3632" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-3632", "url": "https://access.redhat.com/security/cve/CVE-2026-3632" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2445127", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445127" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/483", "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/483" } ], "release_date": "2026-03-17T10:16:00Z", "remediations": [ { "category": "no_fix_planned", "date": "2026-10-15T15:18:34.290806Z", "details": "CVE-2026-3632 is only reachable when an application uses libsoup in a server/proxy role that forwards attacker-controlled hostnames, so libsoup’s common client-only uses are not exposed to the request-smuggling condition this bug enables. Its CVSS details already indicate limited outcomes and prerequisites (User Interaction: Required, Privileges: Low, Scope: Unchanged, and only Low C/I/A), meaning no code execution or privilege escalation. Unless a workload deliberately deploys libsoup/SoupServer as an internet-facing proxy with network reach to sensitive backends, practical exploitation is unlikely, so this issue can be safely deprioritized in enterprise VM/server environments.", "product_ids": [ "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.i686", "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.x86_64", "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.i686", "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.i686", "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "CloudLinux-7:libsoup-0:2.62.2-2.0.13.el7.x86_64", "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.i686", "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.i686", "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.tuxcare.els2.x86_64", "CloudLinux-7:libsoup-devel-0:2.62.2-2.0.13.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }