Junglewise Threat Intelligence

CVE-2026-5119: GNOME libsoup cleartext cookie disclosure in HTTPS proxy tunneling

CVE-2026-5119 · Severity: medium · CVSS 5.9 · Published 2026-03-30

Technologies: Red Hat Enterprise Linux, Gnome Libsoup. Vendors: Red Hat, Gnome.

Executive brief

A security flaw was identified in libsoup, a widely used networking library for GNOME applications and Linux systems. When the library connects to a secure website through an intermediary proxy server, it mistakenly sends sensitive session cookies in an unencrypted format. This could allow a malicious proxy operator or an attacker on the same network to steal user cookies, potentially leading to unauthorized account access or impersonation of the user.

Technical details

A cleartext transmission of sensitive information vulnerability (CWE-319) exists in libsoup and libsoup3. When the library is configured to use an HTTP proxy to establish an HTTPS tunnel, it includes sensitive session cookies in the initial HTTP CONNECT request. Because the CONNECT request itself is not encrypted by the tunnel it is attempting to create, these cookies are transmitted in cleartext. A network-positioned attacker or a malicious HTTP proxy can intercept these headers to perform session hijacking or user impersonation. The vulnerability is mitigated by the fact that it requires the use of a configured HTTP proxy and, in some assessments, user interaction or specific network conditions (AC:H). Patches have been released by Red Hat for various Enterprise Linux versions.

Affected products

  • GNOME libsoup versions prior to 2.72.0-12.el9_7.6, 2.62.3-14.el8_10
  • GNOME libsoup3 versions prior to updates in RHEL 10.0
  • Red Hat Enterprise Linux 7.0, 8.0, 9.0, 10.0

Timeline

  • 2026-03-30: disclosed: Initial disclosure and CVE assignment
  • 2026-03-30: advisory: NVD published date
  • 2026-05-06: patched: Red Hat released security updates for RHEL 8 and 9
  • 2026-05-11: patched: Red Hat released security updates for RHEL 10

References

Related threats