A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade libsoup-develUpgrade libsoup-debugsourceUpgrade libsoup3-docUpgrade libsoup3-develUpgrade libsoup3-debuginfoUpgrade libsoup-docUpgrade libsoup3Upgrade libsoup3-debugsourceUpgrade libsoupUpgrade libsoup-debuginfo | Sep 30, 2026 | Jul 24, 2026 |
| Redhat_linux | — | No solution exists | Jul 27, 2026 | Jun 5, 2026 |
| Ubuntu | — | Upgrade gir1.2-soup-2.4 (Ubuntu Pro)Upgrade libsoup-3.0-commonUpgrade gir1.2-soup-3.0 (Ubuntu Pro)Upgrade libsoup-gnome2.4-1Upgrade libsoup-3.0-dev (Ubuntu Pro)Upgrade libsoup-gnome2.4-devUpgrade libsoup2.4-dev (Ubuntu Pro)Upgrade libsoup-3.0-0Upgrade libsoup-3.0-devUpgrade libsoup-2.4-1Upgrade libsoup-3.0-0 (Ubuntu Pro)Upgrade libsoup-gnome-2.4-1 (Ubuntu Pro)Upgrade gir1.2-soup-3.0Upgrade libsoup-2.4-1 (Ubuntu Pro)Upgrade libsoup2.4-1Upgrade libsoup2.4-devUpgrade libsoup-gnome2.4-dev (Ubuntu Pro)Upgrade libsoup2.4-commonUpgrade libsoup-3.0-common (Ubuntu Pro)Upgrade gir1.2-soup-2.4Upgrade libsoup2.4-1 (Ubuntu Pro)Upgrade libsoup-gnome2.4-1 (Ubuntu Pro)Upgrade libsoup-gnome-2.4-1Upgrade libsoup2.4-common (Ubuntu Pro) | Oct 7, 2026 | Oct 6, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub