Medium ELSA-2026-19356 1 CVE

Moderate: libsoup security update (Oracle Linux 9)

Published Jun 23, 2026 · Updated Jun 23, 2026

Ecosystem: Oracle Linux

Summary

[2.72.0-16.1]
- Backport patch for CVE-2026-5119

[2.72.0-16]
- Backport patch for CVE-2026-1761

[2.72.0-15]
- Backport patch for CVE-2026-0719
- Fix NTLM authentication test failures in FIPS mode

[2.72.0-14]
- Backport patch for CVE-2025-14523

[2.72.0-13]
- Backport patch for CVE-2025-4945 and CVE-2025-11021

Fixed packages 2

Release	Package	Fixed in
Oracle Linux · 9	libsoup	0:2.72.0-16.el9_8.1
Oracle Linux · 9	libsoup-devel	0:2.72.0-16.el9_8.1

Vulnerabilities 1

Medium 5.9

CVE-2026-5119

Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux

Mar 30, 2026