Red Hat Security Advisory: libsoup3 security update

Fixed packages 5

Vulnerabilities 2

• Medium 5.9
  CVE-2026-5119

  Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment

  A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Mar 30, 2026
• Medium 5.3
  CVE-2026-4271

  Libsoup: libsoup: denial of service via use-after-free in http/2 server

  A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by sending specially crafted HTTP/2 requests that cause authentica…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Mar 17, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2448044
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2452932
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_17482.json
• report
  https://access.redhat.com/security/cve/CVE-2026-4271
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-4271
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-4271
• article
  https://gitlab.gnome.org/GNOME/libsoup/-/issues/496
• report
  https://access.redhat.com/security/cve/CVE-2026-5119
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-5119
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-5119
• article
  https://gitlab.gnome.org/GNOME/libsoup/-/issues/502