What is the CVSS score of EUVD-2026-12560?

EUVD-2026-12560 has a CVSS 3.1 base score of 3.9 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Ubuntu are affected by EUVD-2026-12560?

CVE-2026-3633 is a low-severity vulnerability in A flaw (CVSS 3.9). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.. A patch is available.

How to fix or mitigate EUVD-2026-12560?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Ubuntu EUVD-2026-12560

| CVE-2026-3633 LOW

Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)

2026-03-17 redhat

Code Injection Ubuntu Debian

3.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.9 LOW

AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

Ubuntu

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 17, 2026 - 11:57 euvd

EUVD-2026-12560

Analysis Generated

Mar 17, 2026 - 11:57 vuln.today

CVE Published

Mar 17, 2026 - 09:44 nvd

LOW 3.9

DescriptionCVE.org

A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the soup_message_new() function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.

AnalysisAI

A security vulnerability in A flaw (CVSS 3.9). Remediation should follow standard vulnerability management procedures.

Technical ContextAI

Vulnerability type not specified by vendor. Affects A flaw.

RemediationAI

Monitor vendor channels for patch availability.

Same weakness CWE-93 – Improper Neutralization of CRLF Sequences ('CRLF Injection')

View all

CVE-2016-3115 MEDIUM POC

6.4

CVE-2021-39172 HIGH POC

8.8

CVE-2026-23953 HIGH POC

8.7

CVE-2024-45302 HIGH POC

7.8

CVE-2017-5868 MEDIUM POC

6.1

CVE-2026-21428 HIGH POC

7.5

CVE-2022-0666 HIGH POC

7.5

CVE-2019-10678 HIGH POC

7.5

Same technique Code Injection

View all

CVE-2012-0158 HIGH POC

8.8

CVE-2014-6287 CRITICAL POC

9.8

CVE-2017-7494 CRITICAL POC

9.8

CVE-2025-24893 CRITICAL POC

9.8

CVE-2025-47812 CRITICAL POC

10.0

CVE-2013-3906 HIGH POC

7.8

CVE-2017-9822 HIGH POC

8.8

CVE-2018-1273 CRITICAL POC

9.8

Vendor StatusVendor

Ubuntu

Priority: Medium

libsoup2.4

Release	Status	Version
upstream	needs-triage	-
bionic	deferred	2026-03-11
focal	deferred	2026-03-11
jammy	deferred	2026-03-11
noble	deferred	2026-03-11
questing	deferred	2026-03-11
xenial	deferred	2026-03-11

libsoup3

Release	Status	Version
upstream	needs-triage	-
jammy	deferred	2026-03-11
noble	deferred	2026-03-11
questing	deferred	2026-03-11

Debian

Bug #1130500

libsoup2.4

Release	Status	Fixed Version	Urgency
bullseye	vulnerable	2.72.0-2	-
bullseye (security)	vulnerable	2.72.0-2+deb11u3	-
bookworm	vulnerable	2.74.3-1+deb12u1	-
trixie	vulnerable	2.74.3-10.1	-
(unstable)	fixed	(unfixed)	-

libsoup3

Release	Status	Fixed Version	Urgency
bookworm	vulnerable	3.2.3-0+deb12u2	-
trixie	vulnerable	3.6.5-3	-
forky, sid	vulnerable	3.6.6-1	-
(unstable)	fixed	(unfixed)	-

EUVD-2026-12560 vulnerability details – vuln.today

Back

Ubuntu EUVD-2026-12560

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-93 – Improper Neutralization of CRLF Sequences ('CRLF Injection')

Same technique Code Injection

Vendor StatusVendor

Ubuntu

Debian

Share

External POC / Exploit Code