CVE-2026-5119Medium· 5.9▾ SunlitA flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HT…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.
libsoup3 (all versions)libsoup3 (all versions)libsoup3 (all versions)libsoup (all versions)libsoup (all versions)libsoup (all versions)libsoup (all versions)libsoup (all versions)libsoup (all versions)libsoup (all versions)libsoup (all versions)libsoup (all versions)libsoup (all versions)libsoup (all versions)libsoup (all versions)libsoup (all versions)libsoup (all versions)libsoup (all versions)libsoupRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-4271Medium· 5.3Libsoup: libsoup: denial of service via use-after-free in http/2 server
CVE-2026-77680Medium· 5.3Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix
CVE-2026-77014Medium· 5.3Libsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responses
CVE-2026-66337Medium· 6.5Libsoup: libsoup: heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()
CVE-2026-66339Medium· 6.5Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels
CVE-2026-3099Medium· 5.8Libsoup: libsoup: authentication bypass via digest authentication replay attack