A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libsoupUpgrade libsoup-devel | May 7, 2026 | May 6, 2026 |
| Amazon_linux_2023 | — | Upgrade libsoupUpgrade libsoup3-docUpgrade libsoup-develUpgrade libsoup-debugsourceUpgrade libsoup3Upgrade libsoup3-debugsourceUpgrade libsoup-docUpgrade libsoup-debuginfoUpgrade libsoup3-develUpgrade libsoup3-debuginfo | May 28, 2026 | Mar 30, 2026 |
| Oracle_linux | — | Upgrade libsoup3-develUpgrade libsoup3Upgrade libsoup-develUpgrade libsoupUpgrade libsoup3-doc | May 7, 2026 | Mar 30, 2026 |
| Redhat_linux | — | Upgrade libsoup3No solution existsUpgrade libsoup3-debuginfoUpgrade libsoup-develUpgrade libsoup3-debugsourceUpgrade libsoupUpgrade libsoup-debuginfoUpgrade libsoup3-develUpgrade libsoup-debugsourceUpgrade libsoup3-doc | May 8, 2026 | Mar 30, 2026 |
| Rocky_linux | — | Upgrade libsoup3-develUpgrade libsoup3-debugsourceUpgrade libsoup-debuginfoUpgrade libsoup3-debuginfoUpgrade libsoup3Upgrade libsoup-develUpgrade libsoup-debugsourceUpgrade libsoup | May 11, 2026 | May 7, 2026 |
| Ubuntu | — | Upgrade libsoup-gnome2.4-1 (Ubuntu Pro)Upgrade libsoup2.4-commonUpgrade libsoup2.4-tests (Ubuntu Pro)Upgrade libsoup2.4-1Upgrade libsoup2.4-devUpgrade libsoup2.4-1 (Ubuntu Pro)Upgrade libsoup2.4-common (Ubuntu Pro)Upgrade libsoup-gnome-2.4-1Upgrade libsoup2.4-testsUpgrade libsoup-2.4-1Upgrade libsoup-2.4-1 (Ubuntu Pro)Upgrade libsoup-gnome-2.4-1 (Ubuntu Pro)Upgrade libsoup-gnome2.4-1Upgrade libsoup2.4-dev (Ubuntu Pro) | Jul 12, 2026 | Jul 9, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub