CVE-2026-66339
published 2026-07-24CVE-2026-66339: A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to…
PriorityP334medium6.5CVSS 3.1
AVNACLPRNUIRSUCHINAN
EPSS
0.25%
15.1th percentile
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libsoup3 | — | — |
| gnome | libsoup | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| ubuntu | libsoup2.4 | — | — |
| ubuntu | libsoup3 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
vendor_ubuntu7.5HIGH
vendor_redhat3.4LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Red Hat Enterprise Linux libsoup information disclosure (EUVD-2026-48751)
vuldb·2026-07-25·CVSS 6.5
CVE-2026-66339 [MEDIUM] Red Hat Enterprise Linux libsoup information disclosure (EUVD-2026-48751)
A vulnerability was found in Red Hat Enterprise Linux and classified as problematic. Affected is an unknown function of the component libsoup. Such manipulation leads to information disclosure.
This vulnerability is referenced as CVE-2026-66339. It is possible to launch the attack remotely. No exploit is available.
GHSA
A flaw was found in libsoup.
ghsa_unreviewed·2026-07-25
CVE-2026-66339 [MEDIUM] CWE-201 A flaw was found in libsoup.
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.
Ubuntu
libsoup vulnerabilities
vendor_ubuntu·2026-10-06·CVSS 7.5
CVE-2026-77014 [HIGH] libsoup vulnerabilities
Title: libsoup vulnerabilities
Summary: Several security issues were fixed in libsoup.
It was discovered that libsoup incorrectly handled certain HTTP/2 requests.
A remote attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.
(CVE-2026-4271)
It was discovered that libsoup incorrectly handled certain HTTPS proxy
connections. A remote attacker could possibly use this issue to obtain
sensitive information. This issue only affected Ubuntu 22.04 LTS, Ubuntu
24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-5119)
It was discovered that libsoup incorrectly parsed certain chunked HTTP
requests. A remote attacker could possibly use this issue to bypass
security controls. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.
Red Hat
libsoup: libsoup: Proxy credentials leak to destination server via Proxy-Authorization header in CONNECT tunnels
vendor_redhat·2026-06-05·CVSS 3.4
CVE-2026-66339 [LOW] CWE-201 libsoup: libsoup: Proxy credentials leak to destination server via Proxy-Authorization header in CONNECT tunnels
libsoup: libsoup: Proxy credentials leak to destination server via Proxy-Authorization header in CONNECT tunnels
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.
Statement: A flaw was found in libsoup where the proxy authentication logic in SoupAuthManager unconditionally attaches the Proxy-Authorization header to all outgoing requests, including those sent through an already-established CONNECT tunnel. This causes proxy credentials to be sent in cleartext to destination servers, which can capture and reuse the
No detection rules found.
No public exploits indexed.
2026-07-24
Published