{"id":"CVE-2026-5119","title":"Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment","summary":"A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HT…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","cvssSource":"cna","cwe":["CWE-319"],"vendor":"Red Hat","product":"libsoup3","affected":["libsoup3 (all versions)","libsoup3 (all versions)","libsoup3 (all versions)","libsoup (all versions)","libsoup (all versions)","libsoup (all versions)","libsoup (all versions)","libsoup (all versions)","libsoup (all versions)","libsoup (all versions)","libsoup (all versions)","libsoup (all versions)","libsoup (all versions)","libsoup (all versions)","libsoup (all versions)","libsoup (all versions)","libsoup (all versions)","libsoup (all versions)","libsoup"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-03-30T16:00:52.017996Z"},"published":"2026-03-30","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:17:48.200Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-5119","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:13978","label":"RHSA-2026:13978"},{"url":"https://access.redhat.com/errata/RHSA-2026:14087","label":"RHSA-2026:14087"},{"url":"https://access.redhat.com/errata/RHSA-2026:15968","label":"RHSA-2026:15968"},{"url":"https://access.redhat.com/errata/RHSA-2026:17482","label":"RHSA-2026:17482"},{"url":"https://access.redhat.com/errata/RHSA-2026:19143","label":"RHSA-2026:19143"},{"url":"https://access.redhat.com/errata/RHSA-2026:19356","label":"RHSA-2026:19356"},{"url":"https://access.redhat.com/errata/RHSA-2026:21686","label":"RHSA-2026:21686"},{"url":"https://access.redhat.com/errata/RHSA-2026:22316","label":"RHSA-2026:22316"},{"url":"https://access.redhat.com/errata/RHSA-2026:22317","label":"RHSA-2026:22317"},{"url":"https://access.redhat.com/errata/RHSA-2026:22323","label":"RHSA-2026:22323"},{"url":"https://access.redhat.com/errata/RHSA-2026:22710","label":"RHSA-2026:22710"},{"url":"https://access.redhat.com/errata/RHSA-2026:22716","label":"RHSA-2026:22716"},{"url":"https://access.redhat.com/errata/RHSA-2026:24344","label":"RHSA-2026:24344"},{"url":"https://access.redhat.com/errata/RHSA-2026:24722","label":"RHSA-2026:24722"},{"url":"https://access.redhat.com/security/cve/CVE-2026-5119"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452932","label":"RHBZ#2452932"},{"url":"https://gitlab.gnome.org/GNOME/libsoup/-/issues/502"}],"tags":["cve.org"],"epss":0.00259,"epssPercentile":0.17633,"ingestedAt":"2026-11-05T22:38:32.037Z","slug":"CVE-2026-5119","body":"## Overview\n\nA flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.\n\n## Affected\n\n- `libsoup3 (all versions)`\n- `libsoup3 (all versions)`\n- `libsoup3 (all versions)`\n- `libsoup (all versions)`\n- `libsoup (all versions)`\n- `libsoup (all versions)`\n- `libsoup (all versions)`\n- `libsoup (all versions)`\n- `libsoup (all versions)`\n- `libsoup (all versions)`\n- `libsoup (all versions)`\n- `libsoup (all versions)`\n- `libsoup (all versions)`\n- `libsoup (all versions)`\n- `libsoup (all versions)`\n- `libsoup (all versions)`\n- `libsoup (all versions)`\n- `libsoup (all versions)`\n- `libsoup`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nTo mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}