A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade libsoup3-docUpgrade libsoup3-develUpgrade libsoup3-debugsourceUpgrade libsoup3-debuginfoUpgrade libsoup3 | Sep 30, 2026 | Jul 24, 2026 |
| Redhat_linux | — | No solution exists | Jul 27, 2026 | Jun 5, 2026 |
| Ubuntu | — | Upgrade libsoup2.4-commonUpgrade libsoup2.4-1 (Ubuntu Pro)Upgrade libsoup-gnome2.4-dev (Ubuntu Pro)Upgrade libsoup-gnome2.4-1 (Ubuntu Pro)Upgrade libsoup-gnome-2.4-1Upgrade libsoup2.4-common (Ubuntu Pro)Upgrade libsoup2.4-devUpgrade gir1.2-soup-2.4Upgrade libsoup-3.0-common (Ubuntu Pro)Upgrade libsoup2.4-1Upgrade gir1.2-soup-3.0Upgrade libsoup-3.0-dev (Ubuntu Pro)Upgrade libsoup-gnome2.4-devUpgrade libsoup-gnome-2.4-1 (Ubuntu Pro)Upgrade libsoup-2.4-1 (Ubuntu Pro)Upgrade libsoup-3.0-0Upgrade libsoup-3.0-devUpgrade libsoup2.4-dev (Ubuntu Pro)Upgrade libsoup-3.0-commonUpgrade gir1.2-soup-3.0 (Ubuntu Pro)Upgrade gir1.2-soup-2.4 (Ubuntu Pro)Upgrade libsoup-gnome2.4-1Upgrade libsoup-2.4-1Upgrade libsoup-3.0-0 (Ubuntu Pro) | Oct 7, 2026 | Oct 6, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub