Is CVE-2026-5119 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5119 being exploited in the wild.

How severe is CVE-2026-5119?

Medium severity, with a CVSS score of 5.9, published 30 March 2026.

Which products and versions are affected?

Gnome Libsoup libsoup 2.x, libsoup 3.x, versions prior to 2.72.0-12.el9_7.6, 2.62.3-14.el8_10; Gnome Libsoup3 versions prior to updates in RHEL 10.0.

Is there a fix for CVE-2026-5119?

A patch was published on 2026-05-06: Red Hat released security updates for RHEL 8 and 9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5119 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-5119?

Check whether you run Gnome Libsoup or Gnome Libsoup3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5119: GNOME libsoup cleartext cookie disclosure in HTTPS proxy tunneling

CVE-2026-5119 · Severity: medium · CVSS 5.9 · Published 2026-03-30

A security flaw was identified in libsoup, a widely used networking library for GNOME applications and Linux systems. When the library connects to a secure website through an intermediary proxy server, it mistakenly sends sensitive session cookies in an unencrypted format. This could allow a malicious proxy operator or an attacker on the same network to steal user cookies, potentially leading to unauthorized account access or impersonation of the user.

Technologies: Gnome Libsoup. Vendors: Gnome.

Quick answers

Is CVE-2026-5119 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5119 being exploited in the wild.
How severe is CVE-2026-5119?: Medium severity, with a CVSS score of 5.9, published 30 March 2026.
Which products and versions are affected?: Gnome Libsoup libsoup 2.x, libsoup 3.x, versions prior to 2.72.0-12.el9_7.6, 2.62.3-14.el8_10; Gnome Libsoup3 versions prior to updates in RHEL 10.0.
Is there a fix for CVE-2026-5119?: A patch was published on 2026-05-06: Red Hat released security updates for RHEL 8 and 9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5119 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-5119?: Check whether you run Gnome Libsoup or Gnome Libsoup3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A cleartext transmission of sensitive information vulnerability (CWE-319) exists in libsoup and libsoup3. When the library is configured to use an HTTP proxy to establish an HTTPS tunnel, it includes sensitive session cookies in the initial HTTP CONNECT request. Because the CONNECT request itself is not encrypted by the tunnel it is attempting to create, these cookies are transmitted in cleartext. A network-positioned attacker or a malicious HTTP proxy can intercept these headers to perform session hijacking or user impersonation. The vulnerability is mitigated by the fact that it requires the use of a configured HTTP proxy and, in some assessments, user interaction or specific network conditions (AC:H). Patches have been released by Red Hat for various Enterprise Linux versions.

Affected products

GNOME libsoup versions prior to 2.72.0-12.el9_7.6, 2.62.3-14.el8_10
GNOME libsoup3 versions prior to updates in RHEL 10.0
Red Hat Enterprise Linux 7.0, 8.0, 9.0, 10.0

Timeline

2026-03-30: disclosed: Initial disclosure and CVE assignment
2026-03-30: advisory: NVD published date
2026-05-06: patched: Red Hat released security updates for RHEL 8 and 9
2026-05-11: patched: Red Hat released security updates for RHEL 10

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.