Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment

Summary

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.

Timeline

1. Mar 30, 2026, 5:35 AM UTCCVE published
2. Mar 30, 2026, 4:00 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Jun 9, 2026, 8:57 AM UTCRecord last updated

Affected versions

• libsoup3

  Version range not reported

• libsoup3

  Version range not reported

• libsoup3

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

References 17