CVE-2026-5119

MEDIUM

Published:Mar 30, 2026(Today)

Modified:Mar 30, 2026

Vulnerability Description

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.

Attack Characteristics

Network AccessHigh ComplexityNo Auth NeededUser Interaction Required

🤖

AI analysis not yet available

Plain-English explanation, risk summary, and remediation steps will appear here once AI analysis is complete.

References

https://access.redhat.com/security/cve/CVE-2026-5119
https://bugzilla.redhat.com/show_bug.cgi?id=2452932
https://gitlab.gnome.org/GNOME/libsoup/-/issues/502

CVSS Score

v3.1

5.9/ 10.0

MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

At a Glance

Affected Products

References

CVSS v3 Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

CVE-2026-5119

✦ Vulnerability Description

Attack Characteristics

References

CVSS Score

At a Glance

CVSS v3 Vector

Impact Analysis

Vulnerability Description