medium6.5
CVE-2026-66339
A flaw was found in libsoup.
Impact
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gnome | Libsoup | All versions |
| Redhat | Enterprise Linux | Versions 6.0, 7.0, 8.0, 9.0, 10.0 |