CVE-2026-5119: Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-30 · updated 2026-06-17
Weakness: CWE-319

Description

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.

Affected products

GNOME libsoup: all versions
Red Hat Enterprise Linux: 7.0, 8.0, 9.0, 10.0

References

https://access.redhat.com/errata/RHSA-2026:13978
https://access.redhat.com/errata/RHSA-2026:14087
https://access.redhat.com/errata/RHSA-2026:15968
https://access.redhat.com/errata/RHSA-2026:17482
https://access.redhat.com/errata/RHSA-2026:19143
https://access.redhat.com/errata/RHSA-2026:19356
https://access.redhat.com/errata/RHSA-2026:21686
https://access.redhat.com/errata/RHSA-2026:22316
https://access.redhat.com/errata/RHSA-2026:22317
https://access.redhat.com/errata/RHSA-2026:22323
https://access.redhat.com/errata/RHSA-2026:22710
https://access.redhat.com/errata/RHSA-2026:22716

Get alerted when CVE-2026-5119 or the next vulnerability affects your stack