CVE-2026-5119
EUVD-2026-1706230.03.2026, 07:15
A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| gnome | libsoup | - |
| redhat | enterprise_linux | 7.0 |
| redhat | enterprise_linux | 8.0 |
| redhat | enterprise_linux | 9.0 |
| redhat | enterprise_linux | 10.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| libsoup2.4 |
| ||||||||||||||||
| libsoup3 |
|
Red Hat Enterprise Linux Releases
Red Hat Product | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| libsoup |
| ||||||||||||
| libsoup-devel |
|
Amazon Linux Releases
Amazon Package | |||
|---|---|---|---|
| libsoup |
| ||
| libsoup-debuginfo |
| ||
| libsoup-debugsource |
| ||
| libsoup-devel |
| ||
| libsoup-doc |
| ||
| libsoup3 |
| ||
| libsoup3-debuginfo |
| ||
| libsoup3-debugsource |
| ||
| libsoup3-devel |
| ||
| libsoup3-doc |
|
Common Weakness Enumeration
References