Vulnerability · Published Jul 24, 2026 · Assigned by redhat
CVE-2026-66339Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels
Medium 6.5
In plain English
A medium-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libsoup2.4 | no fix listed | DEBIAN-CVE-2026-66339 |
| Debian:13 | libsoup2.4 | no fix listed | DEBIAN-CVE-2026-66339 |
| Debian:12 | libsoup3 | no fix listed | DEBIAN-CVE-2026-66339 |
| Debian:13 | libsoup3 | no fix listed | DEBIAN-CVE-2026-66339 |
| Ubuntu:22.04:LTS | libsoup2.4 | 2.74.2-3ubuntu0.9 | UBUNTU-CVE-2026-66339 |
| Ubuntu:22.04:LTS | libsoup2.4 | 2.74.2-3ubuntu0.9 | USN-8890-1 |
| Ubuntu:24.04:LTS | libsoup2.4 | 2.74.3-6ubuntu1.9 | USN-8890-1 |
| Ubuntu:24.04:LTS | libsoup2.4 | 2.74.3-6ubuntu1.9 | UBUNTU-CVE-2026-66339 |
| Ubuntu:26.10 | libsoup2.4 | no fix listed | UBUNTU-CVE-2026-66339 |
| Ubuntu:24.04:LTS | libsoup3 | 3.4.4-5ubuntu0.9 | UBUNTU-CVE-2026-66339 |
| Ubuntu:24.04:LTS | libsoup3 | 3.4.4-5ubuntu0.9 | USN-8890-1 |
| Ubuntu:26.04:LTS | libsoup3 | 3.6.6-1ubuntu0.1 | UBUNTU-CVE-2026-66339 |
| Ubuntu:26.04:LTS | libsoup3 | 3.6.6-1ubuntu0.1 | USN-8890-1 |
| Ubuntu:26.10 | libsoup3 | 3.6.6-1ubuntu3 | UBUNTU-CVE-2026-66339 |
| Ubuntu:26.10 | libsoup3 | 3.6.6-1ubuntu3 | USN-8890-2 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-201 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References
- https://access.redhat.com/security/cve/CVE-2026-66339 vdb-entry, x_refsource_REDHAT
- RHBZ#2506951 issue-tracking, x_refsource_REDHAT