Moderate Security Vulnerability in libsoup: Information Disclosure via Cleartext Transmission of Cookies
Summary
ALSA-2026:13978: Moderate: libsoup security update. Affects libsoup versions < 2.72.0-12.el9_7.6. Fixed in 2.72.0-12.el9_7.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libsoup is an HTTP client and server library designed for the GNOME desktop environment. It facilitates the development of applications that require network communication, providing a robust framework for handling HTTP requests and responses. The library is widely used in various applications, making its security critical. The vulnerability in question arises from the way libsoup handles cookie transmission during HTTPS tunnel establishment, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability identified as CVE-2026-5119 allows for information disclosure due to the cleartext transmission of cookies during the establishment of HTTPS tunnels. This flaw can be exploited by attackers to intercept sensitive data, including authentication tokens and session cookies, leading to unauthorized access to user accounts and other sensitive information. The issue stems from improper handling of secure connections, which can compromise the confidentiality of user data.
How To Fix
Minimum fixed version
2.72.0-12.el9_7.6
This is the first release that contains the fix.
sudo dnf update libsoupTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional security measures such as using a VPN to encrypt all traffic, which can help mitigate the risk of data interception until the package is updated.
Conclusion
The libsoup library has a moderate security vulnerability (CVE-2026-5119) that can lead to information disclosure through the cleartext transmission of cookies. It is crucial for users to update their packages to the latest version to mitigate this risk. Temporary workarounds can provide additional security until the update is applied.
See every vulnerability recorded for libsoup →
FAQ
CVE-2026-5119 is a security vulnerability in the libsoup library that allows for the cleartext transmission of cookies during HTTPS tunnel establishment, potentially leading to information disclosure.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to unauthorized access to user accounts and sensitive information due to the interception of cookies and authentication tokens.
Yes, a patch is available in the form of an updated version of the libsoup and libsoup-devel packages, specifically version 2.72.0-12.el9_7.6.
If immediate updates are not possible, consider using a VPN to encrypt your traffic as a temporary measure to protect against potential data interception.
Related vulnerabilities
Recent vulnerabilities recorded for libsoup.
