A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libsoup-develUpgrade libsoup | May 7, 2026 | May 6, 2026 |
| Amazon_linux_2023 | — | Upgrade libsoup3Upgrade libsoup-docUpgrade libsoup3-debuginfoUpgrade libsoup3-develUpgrade libsoup-debuginfoUpgrade libsoup3-debugsourceUpgrade libsoup3-docUpgrade libsoup-debugsourceUpgrade libsoup-develUpgrade libsoup | May 28, 2026 | Mar 30, 2026 |
| Oracle_linux | — | Upgrade libsoup-develUpgrade libsoupUpgrade libsoup3Upgrade libsoup3-develUpgrade libsoup3-doc | May 7, 2026 | Mar 30, 2026 |
| Redhat_linux | — | Upgrade libsoup3-docUpgrade libsoup-debuginfoUpgrade libsoup3-develUpgrade libsoup-debugsourceUpgrade libsoup-develUpgrade libsoupNo solution existsUpgrade libsoup3Upgrade libsoup3-debuginfoUpgrade libsoup3-debugsource | May 8, 2026 | Mar 30, 2026 |
| Rocky_linux | — | Upgrade libsoup-develUpgrade libsoup-debugsourceUpgrade libsoupUpgrade libsoup3-debuginfoUpgrade libsoup3-develUpgrade libsoup-debuginfoUpgrade libsoup3-debugsourceUpgrade libsoup3 | May 11, 2026 | May 7, 2026 |
| Ubuntu | — | Upgrade libsoup2.4-devUpgrade libsoup2.4-common (Ubuntu Pro)Upgrade libsoup-gnome2.4-1 (Ubuntu Pro)Upgrade libsoup-gnome-2.4-1Upgrade libsoup2.4-tests (Ubuntu Pro)Upgrade libsoup2.4-1Upgrade libsoup2.4-commonUpgrade libsoup2.4-1 (Ubuntu Pro)Upgrade libsoup-2.4-1Upgrade libsoup-gnome-2.4-1 (Ubuntu Pro)Upgrade libsoup2.4-testsUpgrade libsoup-gnome2.4-1Upgrade libsoup-2.4-1 (Ubuntu Pro)Upgrade libsoup2.4-dev (Ubuntu Pro) | Jul 12, 2026 | Jul 9, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub