CVE-2026-5119

Description

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.

CVSS Vector

References

• https://access.redhat.com/security/cve/CVE-2026-5119
• https://bugzilla.redhat.com/show_bug.cgi?id=2452932
• https://gitlab.gnome.org/GNOME/libsoup/-/issues/502