CVE-2026-5119
MEDIUM 5.9 ALL-YEARSA flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.
LIMITED SIGNALS
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.3%chance of exploitation in 30 days · 17th percentile
○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation none, automatable no
Impact if exploited
5.9CVSS 3.1 · MEDIUM · CNA
- ConfidentialityHigh
- IntegrityLow
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ⚠User interaction: A user must take an action (click / open a file)
- ⚠Complexity: Needs a race window or specific setup
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Affected
Products Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 10.0 Extended Update Support Red Hat Enterprise Linux 7 Extended Lifecycle Support Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long Life Add On Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long Life Add On Red Hat Enterprise Linux 8.8 Telecommunications Update Service Red Hat Enterprise Linux 8.8 Update Services For Sap Solutions Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 9.0 Update Services For Sap Solutions Red Hat Enterprise Linux 9.2 Update Services For Sap Solutions Red Hat Enterprise Linux 9.4 Update Services For Sap Solutions Red Hat Enterprise Linux 9.6 Extended Update Support Red Hat Enterprise Linux 6 Libsoup Enterprise Linux
Weakness (CWE)
- CWE-319: Cleartext Transmission of Sensitive Information
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
References and research data (JSON)
Vendor product assessments
Showing 32 of 320 vendor product statements; 288 omitted. Read the full vendor advisory.
libsoup-0:2.62.2-12.el7_9.i686 as a component of Red Hat Enterprise Linux Server (v. 7 ELS) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_9?arch=i686
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup-debuginfo-0:2.62.2-12.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_9?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup3-0:3.6.5-3.el10_0.15.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_0.15?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup3-debugsource-0:3.6.5-3.el10_0.15.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_0.15?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup3-debuginfo-0:3.6.5-3.el10_1.11.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_1.11?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup3-0:3.6.5-3.el10_2.11.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_2.11?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup3-debugsource-0:3.6.5-3.el10_2.11.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_2.11?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup-debugsource-0:2.62.3-14.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_10?arch=i686
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup-debugsource-0:2.62.3-2.el8_4.9.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_4.9?arch=i686
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup-debugsource-0:2.62.3-2.el8_6.9.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_6.9?arch=i686
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup-debuginfo-0:2.62.3-3.el8_8.9.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8.9?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup-debugsource-0:2.62.3-3.el8_8.9.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8.9?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup-debuginfo-0:2.72.0-8.el9_0.10.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_0.10?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup-devel-0:2.72.0-8.el9_0.10.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_0.10?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup-debuginfo-0:2.72.0-8.el9_2.11.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_2.11?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup-0:2.72.0-8.el9_4.10.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_4.10?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup-debugsource-0:2.72.0-8.el9_4.10.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_4.10?arch=i686
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup-0:2.72.0-10.el9_6.7.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_6.7?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup-debugsource-0:2.72.0-10.el9_6.7.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_6.7?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup-0:2.72.0-12.el9_7.6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_7.6?arch=s390x
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup-debugsource-0:2.72.0-12.el9_7.6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_7.6?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup-0:2.72.0-16.el9_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8.1?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup-devel-0:2.72.0-16.el9_8.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8.1?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup-debuginfo-0:2.62.3-14.el8_10.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_10?arch=i686
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup-0:2.62.3-2.el8_4.9.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_4.9?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup-debugsource-0:2.62.3-2.el8_4.9.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_4.9?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup-debuginfo-0:2.62.3-2.el8_6.9.i686 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_6.9?arch=i686
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup-debugsource-0:2.62.3-3.el8_8.9.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8.9?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup3-doc-0:3.6.5-3.el10_2.11.noarch as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_2.11?arch=noarch
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
libsoup as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/libsoup
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
- no fix planned: Out of support scope
libsoup-devel as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/libsoup-devel
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
- no fix planned: Out of support scope
libsoup.src as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/libsoup?arch=src
- workaround: To mitigate this issue, ensure that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If feasible, configure applications to bypass proxies for sensitive connections or utilize a secure proxy solution that encrypts the entire communication channel. A service restart or application reload may be required for changes to take effect.
- no fix planned: Out of support scope
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Gnome | Libsoup | * |
| Redhat | Enterprise Linux | 7.0 |
| Redhat | Enterprise Linux | 8.0 |
| Redhat | Enterprise Linux | 9.0 |
| Redhat | Enterprise Linux | 10.0 |
All CVSS metrics
- MEDIUM 5.9 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N - MEDIUM 5.9 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N - HIGH 8.2 v3.1 · NVD Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
References
Exploit-tagged references (not proof of a PoC)
- https://gitlab.gnome.org/GNOME/libsoup/-/issues/502 CVE record · redhat · Updated 2026-06-09T08:57:31.694Z
NVD · CVE-2026-5119 · Updated 2026-06-17T10:58:27.790
Red Hat · CVE-2026-5119 · Updated 2026-06-30T11:42:19+00:00
Patches & mitigations
- https://access.redhat.com/security/cve/CVE-2026-5119 CVE record · redhat · Updated 2026-06-09T08:57:31.694Z
NVD · CVE-2026-5119 · Updated 2026-06-17T10:58:27.790
Red Hat · CVE-2026-5119 · Updated 2026-06-30T11:42:19+00:00
Advisories
- https://access.redhat.com/errata/RHSA-2026:13978 CVE record · redhat · Updated 2026-06-09T08:57:31.694Z
NVD · CVE-2026-5119 · Updated 2026-06-17T10:58:27.790
Red Hat · CVE-2026-5119 · Updated 2026-06-30T11:42:19+00:00 - https://access.redhat.com/errata/RHSA-2026:14087 CVE record · redhat · Updated 2026-06-09T08:57:31.694Z
NVD · CVE-2026-5119 · Updated 2026-06-17T10:58:27.790
Red Hat · CVE-2026-5119 · Updated 2026-06-30T11:42:19+00:00 - https://access.redhat.com/errata/RHSA-2026:15968 CVE record · redhat · Updated 2026-06-09T08:57:31.694Z
NVD · CVE-2026-5119 · Updated 2026-06-17T10:58:27.790
Red Hat · CVE-2026-5119 · Updated 2026-06-30T11:42:19+00:00 - https://access.redhat.com/errata/RHSA-2026:17482 CVE record · redhat · Updated 2026-06-09T08:57:31.694Z
NVD · CVE-2026-5119 · Updated 2026-06-17T10:58:27.790
Red Hat · CVE-2026-5119 · Updated 2026-06-30T11:42:19+00:00 - https://access.redhat.com/errata/RHSA-2026:19143 CVE record · redhat · Updated 2026-06-09T08:57:31.694Z
NVD · CVE-2026-5119 · Updated 2026-06-17T10:58:27.790
Red Hat · CVE-2026-5119 · Updated 2026-06-30T11:42:19+00:00 - https://access.redhat.com/errata/RHSA-2026:19356 CVE record · redhat · Updated 2026-06-09T08:57:31.694Z
NVD · CVE-2026-5119 · Updated 2026-06-17T10:58:27.790
Red Hat · CVE-2026-5119 · Updated 2026-06-30T11:42:19+00:00 - https://access.redhat.com/errata/RHSA-2026:21686 CVE record · redhat · Updated 2026-06-09T08:57:31.694Z
NVD · CVE-2026-5119 · Updated 2026-06-17T10:58:27.790
Red Hat · CVE-2026-5119 · Updated 2026-06-30T11:42:19+00:00 - https://access.redhat.com/errata/RHSA-2026:22316 CVE record · redhat · Updated 2026-06-09T08:57:31.694Z
NVD · CVE-2026-5119 · Updated 2026-06-17T10:58:27.790
Red Hat · CVE-2026-5119 · Updated 2026-06-30T11:42:19+00:00 - https://access.redhat.com/errata/RHSA-2026:22317 CVE record · redhat · Updated 2026-06-09T08:57:31.694Z
NVD · CVE-2026-5119 · Updated 2026-06-17T10:58:27.790
Red Hat · CVE-2026-5119 · Updated 2026-06-30T11:42:19+00:00 - https://access.redhat.com/errata/RHSA-2026:22323 CVE record · redhat · Updated 2026-06-09T08:57:31.694Z
NVD · CVE-2026-5119 · Updated 2026-06-17T10:58:27.790
Red Hat · CVE-2026-5119 · Updated 2026-06-30T11:42:19+00:00 - https://access.redhat.com/errata/RHSA-2026:22710 CVE record · redhat · Updated 2026-06-09T08:57:31.694Z
NVD · CVE-2026-5119 · Updated 2026-06-17T10:58:27.790
Red Hat · CVE-2026-5119 · Updated 2026-06-30T11:42:19+00:00 - https://access.redhat.com/errata/RHSA-2026:22716 CVE record · redhat · Updated 2026-06-09T08:57:31.694Z
NVD · CVE-2026-5119 · Updated 2026-06-17T10:58:27.790
Red Hat · CVE-2026-5119 · Updated 2026-06-30T11:42:19+00:00 - https://access.redhat.com/errata/RHSA-2026:24344 CVE record · redhat · Updated 2026-06-09T08:57:31.694Z
NVD · CVE-2026-5119 · Updated 2026-06-17T10:58:27.790
Red Hat · CVE-2026-5119 · Updated 2026-06-30T11:42:19+00:00 - https://access.redhat.com/errata/RHSA-2026:24722 CVE record · redhat · Updated 2026-06-09T08:57:31.694Z
NVD · CVE-2026-5119 · Updated 2026-06-17T10:58:27.790
Red Hat · CVE-2026-5119 · Updated 2026-06-30T11:42:19+00:00 - https://bugzilla.redhat.com/show_bug.cgi?id=2452932 CVE record · redhat · Updated 2026-06-09T08:57:31.694Z
NVD · CVE-2026-5119 · Updated 2026-06-17T10:58:27.790
Red Hat · CVE-2026-5119 · Updated 2026-06-30T11:42:19+00:00 - https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5119.json Red Hat · CVE-2026-5119 · Updated 2026-06-30T11:42:19+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-17062 EUVD · EUVD-2026-17062
Technical & other
- https://www.cve.org/CVERecord?id=CVE-2026-5119 Red Hat · CVE-2026-5119 · Updated 2026-06-30T11:42:19+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-5119 Red Hat · CVE-2026-5119 · Updated 2026-06-30T11:42:19+00:00
Sources: NVD · CVE.org · All sources and attribution · EPSS