An attacker could inject arbitrary HTTP headers and request data if an application using libsoup passes unsanitized, user-controlled input to the soup_message_new() function's method parameter.