Every CVE Search/ Get API key

CVE-2026-5119

Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment

5.9 MediumFix available

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
None

Exploit likelihood

0.26%Up 0.2 points since Mar 30, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.9

Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.

Record
CVE-2026-5119
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Weakness
CWE-319
Updated
2026-11-05
EUVDEUVD-2026-17062 5.9

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.

Record
EUVD-2026-17062
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Updated
2026-11-05
GitHub AdvisoriesGHSA-j666-j6hj-fpc7 5.9

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy,...

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.

Record
GHSA-j666-j6hj-fpc7
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Weakness
CWE-319
Updated
2026-11-02
NVD 5.9

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.

Record
CVE-2026-5119
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness
CWE-319
Updated
2026-11-05
OSVDEBIAN-CVE-2026-5119 8.2

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.

Record
DEBIAN-CVE-2026-5119
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVOESA-2026-2026 8.2

libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.

Security Fix(es):

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.(CVE-2026-5119)

Record
OESA-2026-2026
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
Show 46 moreShow less
OSVOESA-2026-2027 8.2

libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.

Security Fix(es):

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.(CVE-2026-5119)

Record
OESA-2026-2027
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVOESA-2026-2028 8.2

libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.

Security Fix(es):

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.(CVE-2026-5119)

Record
OESA-2026-2028
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVOESA-2026-2029 8.2

libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.

Security Fix(es):

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.(CVE-2026-5119)

Record
OESA-2026-2029
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVOESA-2026-2030 8.2

libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.

Security Fix(es):

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.(CVE-2026-5119)

Record
OESA-2026-2030
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVOESA-2026-2379 8.2

libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.

Security Fix(es):

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.(CVE-2026-5119)

Record
OESA-2026-2379
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVOESA-2026-2380 8.2

libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.

Security Fix(es):

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.(CVE-2026-5119)

Record
OESA-2026-2380
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVOESA-2026-2537 8.2

libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.

Security Fix(es):

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.(CVE-2026-5119)

Record
OESA-2026-2537
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:13978 5.9

Red Hat Security Advisory: libsoup security update

Record
RHSA-2026:13978
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:14087 5.9

Red Hat Security Advisory: libsoup security update

Record
RHSA-2026:14087
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:15968 5.9

Red Hat Security Advisory: libsoup3 security update

Record
RHSA-2026:15968
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:17482 5.9

Red Hat Security Advisory: libsoup3 security update

Record
RHSA-2026:17482
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:19143 5.9

Red Hat Security Advisory: libsoup3 security update

Record
RHSA-2026:19143
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:19356 5.9

Red Hat Security Advisory: libsoup security update

Record
RHSA-2026:19356
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:21686 5.9

Red Hat Security Advisory: libsoup security update

Record
RHSA-2026:21686
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:22316 5.9

Red Hat Security Advisory: libsoup security update

Record
RHSA-2026:22316
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:22317 5.9

Red Hat Security Advisory: libsoup security update

Record
RHSA-2026:22317
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:22323 5.9

Red Hat Security Advisory: libsoup security update

Record
RHSA-2026:22323
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:22710 5.9

Red Hat Security Advisory: libsoup security update

Record
RHSA-2026:22710
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:22716 5.9

Red Hat Security Advisory: libsoup security update

Record
RHSA-2026:22716
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:24344 5.9

Red Hat Security Advisory: libsoup security update

Record
RHSA-2026:24344
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:24722 5.9

Red Hat Security Advisory: libsoup security update

Record
RHSA-2026:24722
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVRLSA-2026:13978 5.9

Moderate: libsoup security update

The libsoup packages provide an HTTP client and server library for GNOME.

Security Fix(es):

  • libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:13978
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVRLSA-2026:14087 5.9

Moderate: libsoup security update

The libsoup packages provide an HTTP client and server library for GNOME.

Security Fix(es):

  • libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:14087
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVRLSA-2026:15968 5.9

Moderate: libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

  • libsoup: libsoup: Denial of Service via Use-After-Free in HTTP/2 server (CVE-2026-4271)

  • libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:15968
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVRLSA-2026:19356 5.9

Moderate: libsoup security update

The libsoup packages provide an HTTP client and server library for GNOME.

Security Fix(es):

  • libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:19356
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-5119 8.2

CVE-2026-5119 in libsoup2.4 - Patched by Root

Root has patched CVE-2026-5119 in the libsoup2.4 package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-5119
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-5119 8.2

CVE-2026-5119 in libsoup3 - Patched by Root

Root has patched CVE-2026-5119 in the libsoup3 package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-5119
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-04
OSVUBUNTU-CVE-2026-5119 5.9

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.

Record
UBUNTU-CVE-2026-5119
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVALSA-2026:13978 No score

Moderate: libsoup security update

The libsoup packages provide an HTTP client and server library for GNOME.

Security Fix(es):

  • libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:13978
Updated
2026-11-02
OSVALSA-2026:14087 No score

Moderate: libsoup security update

The libsoup packages provide an HTTP client and server library for GNOME.

Security Fix(es):

  • libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:14087
Updated
2026-11-02
OSVALSA-2026:15968 No score

Moderate: libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

  • libsoup: libsoup: Denial of Service via Use-After-Free in HTTP/2 server (CVE-2026-4271)
  • libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:15968
Updated
2026-11-02
OSVALSA-2026:19143 No score

Moderate: libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

  • libsoup: libsoup: Denial of Service via Use-After-Free in HTTP/2 server (CVE-2026-4271)
  • libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:19143
Updated
2026-11-02
OSVALSA-2026:19356 No score

Moderate: libsoup security update

The libsoup packages provide an HTTP client and server library for GNOME.

Security Fix(es):

  • libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:19356
Updated
2026-11-02
OSVAZL-81516 No score

CVE-2026-5119 affecting package libsoup 3.4.4-18

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.

Record
AZL-81516
Updated
2026-11-05
OSVCLSA-2026-1776681849 No score

libsoup: Fix of CVE-2026-5119

  • CVE-2026-5119: fix cleartext transmission of cookies to HTTP proxy in tunnel_connect() CONNECT request for HTTPS targets
Record
CLSA-2026-1776681849
Updated
2026-11-02
OSVCLSA-2026-1776682775 No score

libsoup: Fix of CVE-2026-5119

  • CVE-2026-5119: fix cleartext transmission of cookies to HTTP proxy in tunnel_connect() CONNECT request for HTTPS targets
Record
CLSA-2026-1776682775
Updated
2026-11-02
OSVCLSA-2026-1777035141 No score

libsoup: Fix of CVE-2026-5119

  • CVE-2026-5119: do not send cookies to a HTTP proxy for a HTTPS request
Record
CLSA-2026-1777035141
Updated
2026-11-02
OSVCLSA-2026-1777035524 No score

libsoup: Fix of CVE-2026-5119

  • CVE-2026-5119: do not send cookies to a HTTP proxy for a HTTPS request
Record
CLSA-2026-1777035524
Updated
2026-11-02
OSVCLSA-2026-1777036238 No score

libsoup: Fix of CVE-2026-5119

  • CVE-2026-5119: do not send cookies to a HTTP proxy for a HTTPS request
Record
CLSA-2026-1777036238
Updated
2026-11-02
OSVCLSA-2026-1790242017 No score

libsoup: Fix of CVE-2026-5119

  • rebase to 2.62.2-2.0.13.el7
  • replace the TuxCare CVE-2026-5119 backport (Patch10018) with the vendor's Patch1013, which carries the same soup-cookie-jar.c change and adds a tests/proxy-test.c regression test ours did not have
  • all other TuxCare CVE patches are unchanged: the 21 remaining, Patch10000 to Patch10021 less the dropped Patch10018, stay declared and applied
Record
CLSA-2026-1790242017
Updated
2026-11-02
OSVCLSA-2026-1790242224 No score

libsoup: Fix of CVE-2026-5119

  • rebase to 2.62.2-2.0.13.el7
  • replace the TuxCare CVE-2026-5119 backport (Patch10018) with the vendor's Patch1013, which carries the same soup-cookie-jar.c change and adds a tests/proxy-test.c regression test ours did not have
  • all other TuxCare CVE patches are unchanged: the 21 remaining, Patch10000 to Patch10021 less the dropped Patch10018, stay declared and applied
Record
CLSA-2026-1790242224
Updated
2026-11-02
OSVCLSA-2026-1790242973 No score

libsoup: Fix of CVE-2026-5119

  • rebase to 2.62.2-2.0.13.el7
  • replace the TuxCare CVE-2026-5119 backport (Patch10018) with the vendor's Patch1013, which carries the same soup-cookie-jar.c change and adds a tests/proxy-test.c regression test ours did not have
  • all other TuxCare CVE patches are unchanged: the 21 remaining, Patch10000 to Patch10021 less the dropped Patch10018, stay declared and applied
Record
CLSA-2026-1790242973
Updated
2026-11-02
OSVCLSA-2026-1791791913 No score

Fix CVE(s): CVE-2026-5119

  • SECURITY UPDATE: secure cookies sent in cleartext to HTTP proxy in CONNECT requests
    • debian/patches/CVE-2026-5119.patch: don't add cookies to a CONNECT request for a tunnelled HTTPS connection in msg_starting_cb() in libsoup/soup-cookie-jar.c
    • CVE-2026-5119
  • debian/patches/fix-tests-AuthDigestQop-none.patch: remove "AuthDigestQop none" from the /Digest/realm3 location and use a file-based accept mutex in tests/httpd.conf.in, so the test server starts with the updated apache2 (which accepts only qop=auth) and when the build runs as root
Record
CLSA-2026-1791791913
Updated
2026-11-02
OSVUSN-8523-1 No score

libsoup2.4 vulnerabilities

Eric Su and Samuel Dainard discovered that libsoup incorrectly handled content with zero-length resources. An attacker could possibly use this issue to trigger a buffer over-read, resulting in information disclosure or a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-2369)

Kona Arctic discovered that libsoup did not properly protect sensitive cookies when establishing HTTPS tunnels through an HTTP proxy. An attacker could possibly use this issue to intercept session cookies, resulting in session hijacking or user impersonation. (CVE-2026-5119)

Record
USN-8523-1
Updated
2026-11-02
OSVUSN-8890-1 No score

libsoup2.4, libsoup3 vulnerabilities

It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-4271)

It was discovered that libsoup incorrectly handled certain HTTPS proxy connections. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-5119)

It was discovered that libsoup incorrectly parsed certain chunked HTTP requests. A remote attacker could possibly use this issue to bypass security controls. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-6324)

It was discovered that libsoup incorrectly handled proxy authentication credentials. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-66339)

It was discovered that libsoup incorrectly handled certain HTTP Range headers. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-77014, CVE-2026-77680)

It was discovered that libsoup incorrectly handled certain HTTP/2 connections. A remote attacker could possibly use this issue to obtain sensitive information or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-85197)

It was discovered that libsoup incorrectly handled certain HTTP/2 transfers. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-85534)

Record
USN-8890-1
Updated
2026-11-02
OSVUSN-8890-2 No score

libsoup3 vulnerabilities

USN-8890-1 fixed vulnerabilities in libsoup. This update provides the corresponding updates for libsoup3 on Ubuntu 26.10.

Original advisory details:

It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-4271)

It was discovered that libsoup incorrectly handled certain HTTPS proxy connections. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-5119)

It was discovered that libsoup incorrectly parsed certain chunked HTTP requests. A remote attacker could possibly use this issue to bypass security controls. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-6324)

It was discovered that libsoup incorrectly handled proxy authentication credentials. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-66339)

It was discovered that libsoup incorrectly handled certain HTTP Range headers. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-77014, CVE-2026-77680)

It was discovered that libsoup incorrectly handled certain HTTP/2 connections. A remote attacker could possibly use this issue to obtain sensitive information or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-85197)

It was discovered that libsoup incorrectly handled certain HTTP/2 transfers. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-85534)

Record
USN-8890-2
Updated
2026-11-02

Affected products

Show 6 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
libsoup
AlmaLinux:9
 before 2.72.0-12.el9_7.6
2.72.0-12.el9_7.6
libsoup-devel
AlmaLinux:9
 before 2.72.0-12.el9_7.6
2.72.0-12.el9_7.6
libsoup
AlmaLinux:8
 before 2.62.3-14.el8_10
2.62.3-14.el8_10
libsoup-devel
AlmaLinux:8
 before 2.62.3-14.el8_10
2.62.3-14.el8_10
libsoup3-doc
AlmaLinux:10
From an advisory covering 2 CVEs
 before 3.6.5-3.el10_1.11
3.6.5-3.el10_1.11
libsoup3
AlmaLinux:10
From an advisory covering 2 CVEs
 before 3.6.5-3.el10_2.11
3.6.5-3.el10_2.11
libsoup3-devel
AlmaLinux:10
From an advisory covering 2 CVEs
 before 3.6.5-3.el10_2.11
3.6.5-3.el10_2.11
libsoup3-doc
AlmaLinux:10
From an advisory covering 2 CVEs
 before 3.6.5-3.el10_2.11
3.6.5-3.el10_2.11
libsoup
AlmaLinux:9
 before 2.72.0-16.el9_8.1
2.72.0-16.el9_8.1
libsoup-devel
AlmaLinux:9
 before 2.72.0-16.el9_8.1
2.72.0-16.el9_8.1
Show 159 moreShow less
Affected packages
PackageAffectedFixed
libsoup
Azure Linux:3
 through 3.4.4-18 None known
libsoup
TuxCare:AlmaLinux:9.2
 before 2.72.0-10.el9_2.3.tuxcare.els3
2.72.0-10.el9_2.3.tuxcare.els3
libsoup-devel
TuxCare:AlmaLinux:9.2
 before 2.72.0-10.el9_2.3.tuxcare.els3
2.72.0-10.el9_2.3.tuxcare.els3
libsoup-doc
TuxCare:AlmaLinux:9.2
 before 2.72.0-10.el9_2.3.tuxcare.els3
2.72.0-10.el9_2.3.tuxcare.els3
libsoup
TuxCare:AlmaLinux:9.6
 before 2.72.0-10.el9_6.3.tuxcare.els3
2.72.0-10.el9_6.3.tuxcare.els3
libsoup-devel
TuxCare:AlmaLinux:9.6
 before 2.72.0-10.el9_6.3.tuxcare.els3
2.72.0-10.el9_6.3.tuxcare.els3
libsoup-doc
TuxCare:AlmaLinux:9.6
 before 2.72.0-10.el9_6.3.tuxcare.els3
2.72.0-10.el9_6.3.tuxcare.els3
libsoup
TuxCare:CentOS:7
 before 2.62.2-2.0.5.el7.tuxcare.els5
2.62.2-2.0.5.el7.tuxcare.els5
libsoup-devel
TuxCare:CentOS:7
 before 2.62.2-2.0.5.el7.tuxcare.els5
2.62.2-2.0.5.el7.tuxcare.els5
libsoup
TuxCare:RHEL:7
 before 2.62.2-2.0.5.el7.tuxcare.els5
2.62.2-2.0.5.el7.tuxcare.els5
libsoup-devel
TuxCare:RHEL:7
 before 2.62.2-2.0.5.el7.tuxcare.els5
2.62.2-2.0.5.el7.tuxcare.els5
libsoup
TuxCare:OracleLinux:7
 before 2.62.2-2.0.5.el7.tuxcare.els5
2.62.2-2.0.5.el7.tuxcare.els5
libsoup-devel
TuxCare:OracleLinux:7
 before 2.62.2-2.0.5.el7.tuxcare.els5
2.62.2-2.0.5.el7.tuxcare.els5
libsoup
TuxCare:OracleLinux:7
 before 2.62.2-2.0.13.el7.tuxcare.els1
2.62.2-2.0.13.el7.tuxcare.els1
libsoup-devel
TuxCare:OracleLinux:7
 before 2.62.2-2.0.13.el7.tuxcare.els1
2.62.2-2.0.13.el7.tuxcare.els1
libsoup
TuxCare:RHEL:7
 before 2.62.2-2.0.13.el7.tuxcare.els1
2.62.2-2.0.13.el7.tuxcare.els1
libsoup-devel
TuxCare:RHEL:7
 before 2.62.2-2.0.13.el7.tuxcare.els1
2.62.2-2.0.13.el7.tuxcare.els1
libsoup
TuxCare:CentOS:7
 before 2.62.2-2.0.13.el7.tuxcare.els1
2.62.2-2.0.13.el7.tuxcare.els1
libsoup-devel
TuxCare:CentOS:7
 before 2.62.2-2.0.13.el7.tuxcare.els1
2.62.2-2.0.13.el7.tuxcare.els1
gir1.2-soup-2.4
TuxCare:Ubuntu:18.04
 before 2.62.1-1ubuntu0.4+tuxcare.els1
2.62.1-1ubuntu0.4+tuxcare.els1
libsoup-gnome2.4-1
TuxCare:Ubuntu:18.04
 before 2.62.1-1ubuntu0.4+tuxcare.els1
2.62.1-1ubuntu0.4+tuxcare.els1
libsoup-gnome2.4-dev
TuxCare:Ubuntu:18.04
 before 2.62.1-1ubuntu0.4+tuxcare.els1
2.62.1-1ubuntu0.4+tuxcare.els1
libsoup2.4-1
TuxCare:Ubuntu:18.04
 before 2.62.1-1ubuntu0.4+tuxcare.els1
2.62.1-1ubuntu0.4+tuxcare.els1
libsoup2.4-dev
TuxCare:Ubuntu:18.04
 before 2.62.1-1ubuntu0.4+tuxcare.els1
2.62.1-1ubuntu0.4+tuxcare.els1
libsoup2.4-doc
TuxCare:Ubuntu:18.04
 before 2.62.1-1ubuntu0.4+tuxcare.els1
2.62.1-1ubuntu0.4+tuxcare.els1
libsoup2.4
Debian:12
 All versions, plus listed versions
2.74.3-12.74.3-1+deb12u12.74.3-102.74.3-10.12.74.3-11
Show 11 moreShow less
2.74.3-22.74.3-32.74.3-3.1~exp12.74.3-3.1~exp22.74.3-3.1~exp32.74.3-52.74.3-62.74.3-72.74.3-82.74.3-8.12.74.3-9
 None known
libsoup2.4
Debian:13
 All versions, plus listed versions
2.74.3-10.12.74.3-11
 None known
libsoup3
Debian:12
 All versions, plus listed versions
3.2.2-23.2.3-0+deb12u13.2.3-0+deb12u23.3.1-13.4.0-1
Show 33 moreShow less
3.4.1-13.4.2-13.4.2-23.4.2-33.4.2-43.4.3-13.4.4-13.4.4-23.4.4-33.4.4-43.4.4-53.5.2-13.6.0-13.6.0-23.6.0-33.6.0-43.6.1-13.6.4-13.6.4-23.6.4-33.6.5-13.6.5-23.6.5-33.6.5-43.6.5-53.6.5-63.6.5-73.6.5-83.6.5-93.6.6-13.8.0-13.8.0-23.8.0-3
 None known
libsoup3
Debian:13
 All versions, plus listed versions
3.6.5-33.6.5-43.6.5-53.6.5-63.6.5-7
Show 6 moreShow less
3.6.5-83.6.5-93.6.6-13.8.0-13.8.0-23.8.0-3
 None known
libsoup
openEuler:24.03-LTS-SP1
 before 2.74.3-16.oe2403sp1
2.74.3-16.oe2403sp1
libsoup
openEuler:24.03-LTS-SP3
 before 2.74.3-16.oe2403sp3
2.74.3-16.oe2403sp3
libsoup
openEuler:20.03-LTS-SP4
 before 2.71.0-15.oe2003sp4
2.71.0-15.oe2003sp4
libsoup
openEuler:22.03-LTS-SP4
 before 2.74.2-16.oe2203sp4
2.74.2-16.oe2203sp4
libsoup
openEuler:24.03-LTS
 before 2.74.3-16.oe2403
2.74.3-16.oe2403
libsoup3
openEuler:24.03-LTS-SP3
 before 3.4.5-14.oe2403sp3
3.4.5-14.oe2403sp3
libsoup3
openEuler:24.03-LTS
 before 3.4.5-14.oe2403
3.4.5-14.oe2403
libsoup3
openEuler:24.03-LTS-SP1
 before 3.4.5-14.oe2403sp1
3.4.5-14.oe2403sp1
libsoup
Red Hat:enterprise_linux:9::appstream
 before 0:2.72.0-12.el9_7.6
0:2.72.0-12.el9_7.6
libsoup-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:2.72.0-12.el9_7.6
0:2.72.0-12.el9_7.6
libsoup-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:2.72.0-12.el9_7.6
0:2.72.0-12.el9_7.6
libsoup-devel
Red Hat:enterprise_linux:9::appstream
 before 0:2.72.0-12.el9_7.6
0:2.72.0-12.el9_7.6
libsoup-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:2.62.3-14.el8_10
0:2.62.3-14.el8_10
libsoup-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:2.62.3-14.el8_10
0:2.62.3-14.el8_10
libsoup-devel
Red Hat:enterprise_linux:8::appstream
 before 0:2.62.3-14.el8_10
0:2.62.3-14.el8_10
libsoup
Red Hat:enterprise_linux:8::baseos
 before 0:2.62.3-14.el8_10
0:2.62.3-14.el8_10
libsoup-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:2.62.3-14.el8_10
0:2.62.3-14.el8_10
libsoup-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:2.62.3-14.el8_10
0:2.62.3-14.el8_10
libsoup3
Red Hat:enterprise_linux:10.1
From an advisory covering 2 CVEs
 before 0:3.6.5-3.el10_1.11
0:3.6.5-3.el10_1.11
libsoup3-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 2 CVEs
 before 0:3.6.5-3.el10_1.11
0:3.6.5-3.el10_1.11
libsoup3-debugsource
Red Hat:enterprise_linux:10.1
From an advisory covering 2 CVEs
 before 0:3.6.5-3.el10_1.11
0:3.6.5-3.el10_1.11
libsoup3-devel
Red Hat:enterprise_linux:10.1
From an advisory covering 2 CVEs
 before 0:3.6.5-3.el10_1.11
0:3.6.5-3.el10_1.11
libsoup3-doc
Red Hat:enterprise_linux:10.1
From an advisory covering 2 CVEs
 before 0:3.6.5-3.el10_1.11
0:3.6.5-3.el10_1.11
libsoup3
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 0:3.6.5-3.el10_0.15
0:3.6.5-3.el10_0.15
libsoup3-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 0:3.6.5-3.el10_0.15
0:3.6.5-3.el10_0.15
libsoup3-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 0:3.6.5-3.el10_0.15
0:3.6.5-3.el10_0.15
libsoup3-devel
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 0:3.6.5-3.el10_0.15
0:3.6.5-3.el10_0.15
libsoup3-doc
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 0:3.6.5-3.el10_0.15
0:3.6.5-3.el10_0.15
libsoup3
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:3.6.5-3.el10_2.11
0:3.6.5-3.el10_2.11
libsoup3-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:3.6.5-3.el10_2.11
0:3.6.5-3.el10_2.11
libsoup3-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:3.6.5-3.el10_2.11
0:3.6.5-3.el10_2.11
libsoup3-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:3.6.5-3.el10_2.11
0:3.6.5-3.el10_2.11
libsoup3-doc
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:3.6.5-3.el10_2.11
0:3.6.5-3.el10_2.11
libsoup
Red Hat:enterprise_linux:9::appstream
 before 0:2.72.0-16.el9_8.1
0:2.72.0-16.el9_8.1
libsoup-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:2.72.0-16.el9_8.1
0:2.72.0-16.el9_8.1
libsoup-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:2.72.0-16.el9_8.1
0:2.72.0-16.el9_8.1
libsoup-devel
Red Hat:enterprise_linux:9::appstream
 before 0:2.72.0-16.el9_8.1
0:2.72.0-16.el9_8.1
libsoup
Red Hat:rhel_e4s:9.0::appstream
 before 0:2.72.0-8.el9_0.10
0:2.72.0-8.el9_0.10
libsoup-debuginfo
Red Hat:rhel_e4s:9.0::appstream
 before 0:2.72.0-8.el9_0.10
0:2.72.0-8.el9_0.10
libsoup-debugsource
Red Hat:rhel_e4s:9.0::appstream
 before 0:2.72.0-8.el9_0.10
0:2.72.0-8.el9_0.10
libsoup-devel
Red Hat:rhel_e4s:9.0::appstream
 before 0:2.72.0-8.el9_0.10
0:2.72.0-8.el9_0.10
libsoup
Red Hat:rhel_e4s:9.2::appstream
 before 0:2.72.0-8.el9_2.11
0:2.72.0-8.el9_2.11
libsoup-debuginfo
Red Hat:rhel_e4s:9.2::appstream
 before 0:2.72.0-8.el9_2.11
0:2.72.0-8.el9_2.11
libsoup-debugsource
Red Hat:rhel_e4s:9.2::appstream
 before 0:2.72.0-8.el9_2.11
0:2.72.0-8.el9_2.11
libsoup-devel
Red Hat:rhel_e4s:9.2::appstream
 before 0:2.72.0-8.el9_2.11
0:2.72.0-8.el9_2.11
libsoup
Red Hat:rhel_eus:9.6::appstream
 before 0:2.72.0-10.el9_6.7
0:2.72.0-10.el9_6.7
libsoup-debuginfo
Red Hat:rhel_eus:9.6::appstream
 before 0:2.72.0-10.el9_6.7
0:2.72.0-10.el9_6.7
libsoup-debugsource
Red Hat:rhel_eus:9.6::appstream
 before 0:2.72.0-10.el9_6.7
0:2.72.0-10.el9_6.7
libsoup-devel
Red Hat:rhel_eus:9.6::appstream
 before 0:2.72.0-10.el9_6.7
0:2.72.0-10.el9_6.7
libsoup
Red Hat:rhel_e4s:9.4::appstream
 before 0:2.72.0-8.el9_4.10
0:2.72.0-8.el9_4.10
libsoup-debuginfo
Red Hat:rhel_e4s:9.4::appstream
 before 0:2.72.0-8.el9_4.10
0:2.72.0-8.el9_4.10
libsoup-debugsource
Red Hat:rhel_e4s:9.4::appstream
 before 0:2.72.0-8.el9_4.10
0:2.72.0-8.el9_4.10
libsoup-devel
Red Hat:rhel_e4s:9.4::appstream
 before 0:2.72.0-8.el9_4.10
0:2.72.0-8.el9_4.10
libsoup-debuginfo
Red Hat:rhel_e4s:8.8::appstream
 before 0:2.62.3-3.el8_8.9
0:2.62.3-3.el8_8.9
libsoup-debugsource
Red Hat:rhel_e4s:8.8::appstream
 before 0:2.62.3-3.el8_8.9
0:2.62.3-3.el8_8.9
libsoup-devel
Red Hat:rhel_e4s:8.8::appstream
 before 0:2.62.3-3.el8_8.9
0:2.62.3-3.el8_8.9
libsoup-debuginfo
Red Hat:rhel_tus:8.8::appstream
 before 0:2.62.3-3.el8_8.9
0:2.62.3-3.el8_8.9
libsoup-debugsource
Red Hat:rhel_tus:8.8::appstream
 before 0:2.62.3-3.el8_8.9
0:2.62.3-3.el8_8.9
libsoup-devel
Red Hat:rhel_tus:8.8::appstream
 before 0:2.62.3-3.el8_8.9
0:2.62.3-3.el8_8.9
libsoup
Red Hat:rhel_e4s:8.8::baseos
 before 0:2.62.3-3.el8_8.9
0:2.62.3-3.el8_8.9
libsoup-debuginfo
Red Hat:rhel_e4s:8.8::baseos
 before 0:2.62.3-3.el8_8.9
0:2.62.3-3.el8_8.9
libsoup-debugsource
Red Hat:rhel_e4s:8.8::baseos
 before 0:2.62.3-3.el8_8.9
0:2.62.3-3.el8_8.9
libsoup
Red Hat:rhel_tus:8.8::baseos
 before 0:2.62.3-3.el8_8.9
0:2.62.3-3.el8_8.9
libsoup-debuginfo
Red Hat:rhel_tus:8.8::baseos
 before 0:2.62.3-3.el8_8.9
0:2.62.3-3.el8_8.9
libsoup-debugsource
Red Hat:rhel_tus:8.8::baseos
 before 0:2.62.3-3.el8_8.9
0:2.62.3-3.el8_8.9
libsoup-debuginfo
Red Hat:rhel_aus:8.4::appstream
 before 0:2.62.3-2.el8_4.9
0:2.62.3-2.el8_4.9
libsoup-debugsource
Red Hat:rhel_aus:8.4::appstream
 before 0:2.62.3-2.el8_4.9
0:2.62.3-2.el8_4.9
libsoup-devel
Red Hat:rhel_aus:8.4::appstream
 before 0:2.62.3-2.el8_4.9
0:2.62.3-2.el8_4.9
libsoup-debuginfo
Red Hat:rhel_eus_long_life:8.4::appstream
 before 0:2.62.3-2.el8_4.9
0:2.62.3-2.el8_4.9
libsoup-debugsource
Red Hat:rhel_eus_long_life:8.4::appstream
 before 0:2.62.3-2.el8_4.9
0:2.62.3-2.el8_4.9
libsoup-devel
Red Hat:rhel_eus_long_life:8.4::appstream
 before 0:2.62.3-2.el8_4.9
0:2.62.3-2.el8_4.9
libsoup
Red Hat:rhel_aus:8.4::baseos
 before 0:2.62.3-2.el8_4.9
0:2.62.3-2.el8_4.9
libsoup-debuginfo
Red Hat:rhel_aus:8.4::baseos
 before 0:2.62.3-2.el8_4.9
0:2.62.3-2.el8_4.9
libsoup-debugsource
Red Hat:rhel_aus:8.4::baseos
 before 0:2.62.3-2.el8_4.9
0:2.62.3-2.el8_4.9
libsoup
Red Hat:rhel_eus_long_life:8.4::baseos
 before 0:2.62.3-2.el8_4.9
0:2.62.3-2.el8_4.9
libsoup-debuginfo
Red Hat:rhel_eus_long_life:8.4::baseos
 before 0:2.62.3-2.el8_4.9
0:2.62.3-2.el8_4.9
libsoup-debugsource
Red Hat:rhel_eus_long_life:8.4::baseos
 before 0:2.62.3-2.el8_4.9
0:2.62.3-2.el8_4.9
libsoup-debuginfo
Red Hat:rhel_aus:8.6::appstream
 before 0:2.62.3-2.el8_6.9
0:2.62.3-2.el8_6.9
libsoup-debugsource
Red Hat:rhel_aus:8.6::appstream
 before 0:2.62.3-2.el8_6.9
0:2.62.3-2.el8_6.9
libsoup-devel
Red Hat:rhel_aus:8.6::appstream
 before 0:2.62.3-2.el8_6.9
0:2.62.3-2.el8_6.9
libsoup-debuginfo
Red Hat:rhel_eus_long_life:8.6::appstream
 before 0:2.62.3-2.el8_6.9
0:2.62.3-2.el8_6.9
libsoup-debugsource
Red Hat:rhel_eus_long_life:8.6::appstream
 before 0:2.62.3-2.el8_6.9
0:2.62.3-2.el8_6.9
libsoup-devel
Red Hat:rhel_eus_long_life:8.6::appstream
 before 0:2.62.3-2.el8_6.9
0:2.62.3-2.el8_6.9
libsoup
Red Hat:rhel_aus:8.6::baseos
 before 0:2.62.3-2.el8_6.9
0:2.62.3-2.el8_6.9
libsoup-debuginfo
Red Hat:rhel_aus:8.6::baseos
 before 0:2.62.3-2.el8_6.9
0:2.62.3-2.el8_6.9
libsoup-debugsource
Red Hat:rhel_aus:8.6::baseos
 before 0:2.62.3-2.el8_6.9
0:2.62.3-2.el8_6.9
libsoup
Red Hat:rhel_eus_long_life:8.6::baseos
 before 0:2.62.3-2.el8_6.9
0:2.62.3-2.el8_6.9
libsoup-debuginfo
Red Hat:rhel_eus_long_life:8.6::baseos
 before 0:2.62.3-2.el8_6.9
0:2.62.3-2.el8_6.9
libsoup-debugsource
Red Hat:rhel_eus_long_life:8.6::baseos
 before 0:2.62.3-2.el8_6.9
0:2.62.3-2.el8_6.9
libsoup
Red Hat:rhel_els:7
 before 0:2.62.2-12.el7_9
0:2.62.2-12.el7_9
libsoup-debuginfo
Red Hat:rhel_els:7
 before 0:2.62.2-12.el7_9
0:2.62.2-12.el7_9
libsoup-devel
Red Hat:rhel_els:7
 before 0:2.62.2-12.el7_9
0:2.62.2-12.el7_9
libsoup
Rocky Linux:9
 before 0:2.72.0-12.el9_7.6
0:2.72.0-12.el9_7.6
libsoup
Rocky Linux:8
 before 0:2.62.3-14.el8_10
0:2.62.3-14.el8_10
libsoup3
Rocky Linux:10
From an advisory covering 2 CVEs
 before 0:3.6.5-3.el10_1.11
0:3.6.5-3.el10_1.11
libsoup
Rocky Linux:9
 before 0:2.72.0-16.el9_8.1
0:2.72.0-16.el9_8.1
libsoup2.4
Root:Debian:12
 before 2.74.3-1+deb12u1.aikido.3
2.74.3-1+deb12u1.aikido.32.74.3-1+deb12u1.aikido.42.74.3-1+deb12u1.aikido.5
rootio-libsoup2.4
Root:Debian:12
 before 2.74.3-1+deb12u1.aikido.3
2.74.3-1+deb12u1.aikido.32.74.3-1+deb12u1.aikido.42.74.3-1+deb12u1.aikido.5
libsoup3
Root:Debian:13
 before 3.6.5-3.aikido.4
3.6.5-3.aikido.43.6.5-3.aikido.33.6.5-3.root.io.13.6.5-3.root.io.23.6.5-3.aikido.53.6.5-3.aikido.63.6.5-3.aikido.73.6.5-3.aikido.83.6.5-3.aikido.9
rootio-libsoup3
Root:Debian:13
 before 3.6.5-3.aikido.4
3.6.5-3.aikido.43.6.5-3.aikido.33.6.5-3.root.io.13.6.5-3.root.io.23.6.5-3.aikido.53.6.5-3.aikido.63.6.5-3.aikido.73.6.5-3.aikido.83.6.5-3.aikido.9
libsoup2.4
Ubuntu:Pro:16.04:LTS
 before 2.52.2-1ubuntu0.3+esm6, plus listed versions
2.50.0-2debian12.52.1-12.52.2-12.52.2-1ubuntu0.12.52.2-1ubuntu0.2
Show 6 moreShow less
2.52.2-1ubuntu0.32.52.2-1ubuntu0.3+esm12.52.2-1ubuntu0.3+esm22.52.2-1ubuntu0.3+esm32.52.2-1ubuntu0.3+esm42.52.2-1ubuntu0.3+esm5
2.52.2-1ubuntu0.3+esm6
libsoup2.4
Ubuntu:Pro:18.04:LTS
 before 2.62.1-1ubuntu0.4+esm7, plus listed versions
2.60.1-12.60.2-12.60.2-22.60.3-12.61.90-1
Show 11 moreShow less
2.62.0-12.62.1-12.62.1-1ubuntu0.12.62.1-1ubuntu0.32.62.1-1ubuntu0.42.62.1-1ubuntu0.4+esm12.62.1-1ubuntu0.4+esm22.62.1-1ubuntu0.4+esm32.62.1-1ubuntu0.4+esm42.62.1-1ubuntu0.4+esm52.62.1-1ubuntu0.4+esm6
2.62.1-1ubuntu0.4+esm7
libsoup2.4
Ubuntu:Pro:20.04:LTS
 before 2.70.0-1ubuntu0.5+esm2, plus listed versions
2.68.2-0ubuntu12.68.2-12.68.2-22.68.2-2build22.69.90-1
Show 7 moreShow less
2.70.0-12.70.0-1ubuntu0.12.70.0-1ubuntu0.22.70.0-1ubuntu0.32.70.0-1ubuntu0.42.70.0-1ubuntu0.52.70.0-1ubuntu0.5+esm1
2.70.0-1ubuntu0.5+esm2
libsoup2.4
Ubuntu:22.04:LTS
 before 2.74.2-3ubuntu0.7, plus listed versions
2.72.0-3ubuntu32.74.1-12.74.2-22.74.2-32.74.2-3ubuntu0.1
Show 5 moreShow less
2.74.2-3ubuntu0.22.74.2-3ubuntu0.32.74.2-3ubuntu0.42.74.2-3ubuntu0.52.74.2-3ubuntu0.6
2.74.2-3ubuntu0.7
libsoup3
Ubuntu:Pro:22.04:LTS
 before 3.0.7-0ubuntu1+esm9, plus listed versions
3.0.4-23.0.4-33.0.5-13.0.7-0ubuntu13.0.7-0ubuntu1+esm1
Show 7 moreShow less
3.0.7-0ubuntu1+esm23.0.7-0ubuntu1+esm33.0.7-0ubuntu1+esm43.0.7-0ubuntu1+esm53.0.7-0ubuntu1+esm63.0.7-0ubuntu1+esm73.0.7-0ubuntu1+esm8
3.0.7-0ubuntu1+esm9
libsoup2.4
Ubuntu:24.04:LTS
 before 2.74.3-6ubuntu1.7, plus listed versions
2.74.3-12.74.3-22.74.3-32.74.3-62.74.3-6build1
Show 7 moreShow less
2.74.3-6ubuntu12.74.3-6ubuntu1.12.74.3-6ubuntu1.22.74.3-6ubuntu1.32.74.3-6ubuntu1.42.74.3-6ubuntu1.52.74.3-6ubuntu1.6
2.74.3-6ubuntu1.7
libsoup3
Ubuntu:24.04:LTS
 before 3.4.4-5ubuntu0.9, plus listed versions
3.4.2-43.4.4-13.4.4-23.4.4-43.4.4-5
Show 10 moreShow less
3.4.4-5build13.4.4-5build23.4.4-5ubuntu0.13.4.4-5ubuntu0.23.4.4-5ubuntu0.33.4.4-5ubuntu0.43.4.4-5ubuntu0.53.4.4-5ubuntu0.63.4.4-5ubuntu0.73.4.4-5ubuntu0.8
3.4.4-5ubuntu0.9
libsoup2.4
Ubuntu:25.10
 before 2.74.3-10.1ubuntu4.1, plus listed versions
2.74.3-102.74.3-10.12.74.3-10.1ubuntu12.74.3-10.1ubuntu22.74.3-10.1ubuntu32.74.3-10.1ubuntu4
2.74.3-10.1ubuntu4.1
libsoup3
Ubuntu:25.10
 All versions, plus listed versions
3.6.5-13.6.5-1ubuntu13.6.5-33.6.5-43.6.5-4ubuntu0.13.6.5-4ubuntu0.2
 None known
libsoup2.4
Ubuntu:26.10
 All versions, plus listed versions
2.74.3-10.1ubuntu5
 None known
libsoup3
Ubuntu:26.10
 before 3.6.6-1ubuntu3, plus listed versions
3.6.6-1
3.6.6-1ubuntu3
libsoup3
Ubuntu:26.04:LTS
 before 3.6.6-1ubuntu0.1, plus listed versions
3.6.5-43.6.5-53.6.5-63.6.5-73.6.5-93.6.6-1
3.6.6-1ubuntu0.1
libsoup2.4
Ubuntu:Pro:26.04:LTS
 before 2.74.3-10.1ubuntu5+esm1, plus listed versions
2.74.3-10.1ubuntu42.74.3-10.1ubuntu5
2.74.3-10.1ubuntu5+esm1
libsoup2.4
Ubuntu:Pro:16.04:LTS
From an advisory covering 2 CVEs
 before 2.52.2-1ubuntu0.3+esm6, plus listed versions
2.50.0-2debian12.52.1-12.52.2-12.52.2-1ubuntu0.12.52.2-1ubuntu0.2
Show 6 moreShow less
2.52.2-1ubuntu0.32.52.2-1ubuntu0.3+esm12.52.2-1ubuntu0.3+esm22.52.2-1ubuntu0.3+esm32.52.2-1ubuntu0.3+esm42.52.2-1ubuntu0.3+esm5
2.52.2-1ubuntu0.3+esm6
libsoup2.4
Ubuntu:Pro:18.04:LTS
From an advisory covering 2 CVEs
 before 2.62.1-1ubuntu0.4+esm7, plus listed versions
2.60.1-12.60.2-12.60.2-22.60.3-12.61.90-1
Show 11 moreShow less
2.62.0-12.62.1-12.62.1-1ubuntu0.12.62.1-1ubuntu0.32.62.1-1ubuntu0.42.62.1-1ubuntu0.4+esm12.62.1-1ubuntu0.4+esm22.62.1-1ubuntu0.4+esm32.62.1-1ubuntu0.4+esm42.62.1-1ubuntu0.4+esm52.62.1-1ubuntu0.4+esm6
2.62.1-1ubuntu0.4+esm7
libsoup2.4
Ubuntu:Pro:20.04:LTS
From an advisory covering 2 CVEs
 before 2.70.0-1ubuntu0.5+esm2, plus listed versions
2.68.2-0ubuntu12.68.2-12.68.2-22.68.2-2build22.69.90-1
Show 7 moreShow less
2.70.0-12.70.0-1ubuntu0.12.70.0-1ubuntu0.22.70.0-1ubuntu0.32.70.0-1ubuntu0.42.70.0-1ubuntu0.52.70.0-1ubuntu0.5+esm1
2.70.0-1ubuntu0.5+esm2
libsoup2.4
Ubuntu:22.04:LTS
From an advisory covering 2 CVEs
 before 2.74.2-3ubuntu0.7, plus listed versions
2.72.0-3ubuntu32.74.1-12.74.2-22.74.2-32.74.2-3ubuntu0.1
Show 5 moreShow less
2.74.2-3ubuntu0.22.74.2-3ubuntu0.32.74.2-3ubuntu0.42.74.2-3ubuntu0.52.74.2-3ubuntu0.6
2.74.2-3ubuntu0.7
libsoup2.4
Ubuntu:24.04:LTS
From an advisory covering 2 CVEs
 before 2.74.3-6ubuntu1.7, plus listed versions
2.74.3-12.74.3-22.74.3-32.74.3-62.74.3-6build1
Show 7 moreShow less
2.74.3-6ubuntu12.74.3-6ubuntu1.12.74.3-6ubuntu1.22.74.3-6ubuntu1.32.74.3-6ubuntu1.42.74.3-6ubuntu1.52.74.3-6ubuntu1.6
2.74.3-6ubuntu1.7
libsoup2.4
Ubuntu:25.10
From an advisory covering 2 CVEs
 before 2.74.3-10.1ubuntu4.1, plus listed versions
2.74.3-102.74.3-10.12.74.3-10.1ubuntu12.74.3-10.1ubuntu22.74.3-10.1ubuntu32.74.3-10.1ubuntu4
2.74.3-10.1ubuntu4.1
libsoup2.4
Ubuntu:Pro:26.04:LTS
From an advisory covering 2 CVEs
 before 2.74.3-10.1ubuntu5+esm1, plus listed versions
2.74.3-10.1ubuntu42.74.3-10.1ubuntu5
2.74.3-10.1ubuntu5+esm1
libsoup2.4
Ubuntu:Pro:16.04:LTS
From an advisory covering 8 CVEs
 before 2.52.2-1ubuntu0.3+esm8, plus listed versions
2.50.0-2debian12.52.1-12.52.2-12.52.2-1ubuntu0.12.52.2-1ubuntu0.2
Show 8 moreShow less
2.52.2-1ubuntu0.32.52.2-1ubuntu0.3+esm12.52.2-1ubuntu0.3+esm22.52.2-1ubuntu0.3+esm32.52.2-1ubuntu0.3+esm42.52.2-1ubuntu0.3+esm52.52.2-1ubuntu0.3+esm62.52.2-1ubuntu0.3+esm7
2.52.2-1ubuntu0.3+esm8
libsoup2.4
Ubuntu:Pro:18.04:LTS
From an advisory covering 8 CVEs
 before 2.62.1-1ubuntu0.4+esm9, plus listed versions
2.60.1-12.60.2-12.60.2-22.60.3-12.61.90-1
Show 13 moreShow less
2.62.0-12.62.1-12.62.1-1ubuntu0.12.62.1-1ubuntu0.32.62.1-1ubuntu0.42.62.1-1ubuntu0.4+esm12.62.1-1ubuntu0.4+esm22.62.1-1ubuntu0.4+esm32.62.1-1ubuntu0.4+esm42.62.1-1ubuntu0.4+esm52.62.1-1ubuntu0.4+esm62.62.1-1ubuntu0.4+esm72.62.1-1ubuntu0.4+esm8
2.62.1-1ubuntu0.4+esm9
libsoup2.4
Ubuntu:Pro:20.04:LTS
From an advisory covering 8 CVEs
 before 2.70.0-1ubuntu0.5+esm4, plus listed versions
2.68.2-0ubuntu12.68.2-12.68.2-22.68.2-2build22.69.90-1
Show 9 moreShow less
2.70.0-12.70.0-1ubuntu0.12.70.0-1ubuntu0.22.70.0-1ubuntu0.32.70.0-1ubuntu0.42.70.0-1ubuntu0.52.70.0-1ubuntu0.5+esm12.70.0-1ubuntu0.5+esm22.70.0-1ubuntu0.5+esm3
2.70.0-1ubuntu0.5+esm4
libsoup2.4
Ubuntu:22.04:LTS
From an advisory covering 8 CVEs
 before 2.74.2-3ubuntu0.9, plus listed versions
2.72.0-3ubuntu32.74.1-12.74.2-22.74.2-32.74.2-3ubuntu0.1
Show 7 moreShow less
2.74.2-3ubuntu0.22.74.2-3ubuntu0.32.74.2-3ubuntu0.42.74.2-3ubuntu0.52.74.2-3ubuntu0.62.74.2-3ubuntu0.72.74.2-3ubuntu0.8
2.74.2-3ubuntu0.9
libsoup3
Ubuntu:Pro:22.04:LTS
From an advisory covering 8 CVEs
 before 3.0.7-0ubuntu1+esm9, plus listed versions
3.0.4-23.0.4-33.0.5-13.0.7-0ubuntu13.0.7-0ubuntu1+esm1
Show 7 moreShow less
3.0.7-0ubuntu1+esm23.0.7-0ubuntu1+esm33.0.7-0ubuntu1+esm43.0.7-0ubuntu1+esm53.0.7-0ubuntu1+esm63.0.7-0ubuntu1+esm73.0.7-0ubuntu1+esm8
3.0.7-0ubuntu1+esm9
libsoup2.4
Ubuntu:24.04:LTS
From an advisory covering 8 CVEs
 before 2.74.3-6ubuntu1.9, plus listed versions
2.74.3-12.74.3-22.74.3-32.74.3-62.74.3-6build1
Show 9 moreShow less
2.74.3-6ubuntu12.74.3-6ubuntu1.12.74.3-6ubuntu1.22.74.3-6ubuntu1.32.74.3-6ubuntu1.42.74.3-6ubuntu1.52.74.3-6ubuntu1.62.74.3-6ubuntu1.72.74.3-6ubuntu1.8
2.74.3-6ubuntu1.9
libsoup3
Ubuntu:24.04:LTS
From an advisory covering 8 CVEs
 before 3.4.4-5ubuntu0.9, plus listed versions
3.4.2-43.4.4-13.4.4-23.4.4-43.4.4-5
Show 10 moreShow less
3.4.4-5build13.4.4-5build23.4.4-5ubuntu0.13.4.4-5ubuntu0.23.4.4-5ubuntu0.33.4.4-5ubuntu0.43.4.4-5ubuntu0.53.4.4-5ubuntu0.63.4.4-5ubuntu0.73.4.4-5ubuntu0.8
3.4.4-5ubuntu0.9
libsoup3
Ubuntu:26.04:LTS
From an advisory covering 8 CVEs
 before 3.6.6-1ubuntu0.1, plus listed versions
3.6.5-43.6.5-53.6.5-63.6.5-73.6.5-93.6.6-1
3.6.6-1ubuntu0.1
libsoup2.4
Ubuntu:Pro:26.04:LTS
From an advisory covering 8 CVEs
 before 2.74.3-10.1ubuntu5+esm3, plus listed versions
2.74.3-10.1ubuntu42.74.3-10.1ubuntu52.74.3-10.1ubuntu5+esm12.74.3-10.1ubuntu5+esm2
2.74.3-10.1ubuntu5+esm3
libsoup3
Ubuntu:26.10
From an advisory covering 8 CVEs
 before 3.6.6-1ubuntu3, plus listed versions
3.6.6-1
3.6.6-1ubuntu3

History

History
RecordedChangedSources
affectedCVE List, EUVD, NVD, OSV
affectedOSV
facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-5119 is a medium vulnerability (CVSS 5.9) in Gnome Libsoup, published March 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in libsoup 2.72.0-12.el9_7.6.

References

Show 75 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open