Moderate Security Vulnerability in libsoup: Information Disclosure via Cleartext Transmission of Cookies
Summary
ALSA-2026:14087: Moderate: libsoup security update. Affects libsoup versions < 2.62.3-14.el8_10. Fixed in 2.62.3-14.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libsoup is an HTTP client and server library designed for GNOME applications, providing essential functionalities for web communication. It supports various features such as HTTP/1.1 and HTTP/2 protocols, making it a critical component for applications that require network interactions. However, it has been identified that libsoup is vulnerable to a security issue that could lead to the exposure of sensitive information during HTTPS tunnel establishment.
Vulnerability Detail
The vulnerability identified as CVE-2026-5119 allows for information disclosure through the cleartext transmission of cookies. This occurs during the establishment of HTTPS tunnels, potentially exposing sensitive user data to malicious actors. The risk is particularly significant in environments where network traffic can be intercepted, leading to unauthorized access to user sessions and other confidential information.
How To Fix
Minimum fixed version
2.62.3-14.el8_10
This is the first release that contains the fix.
sudo dnf update libsoupTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional security measures such as using VPNs or secure tunneling protocols to encrypt traffic and protect against potential interception until the package is updated.
Conclusion
The libsoup package has a moderate security vulnerability (CVE-2026-5119) that can lead to information disclosure through cleartext transmission of cookies. It is crucial to update to the patched version to safeguard against potential attacks. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for libsoup →
FAQ
CVE-2026-5119 is a security vulnerability in libsoup that allows for the cleartext transmission of cookies during HTTPS tunnel establishment, leading to potential information disclosure.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary risk is the exposure of sensitive information, such as user session cookies, which can be exploited by attackers to hijack user sessions or gain unauthorized access to user data.
Yes, a patch is available in the form of an updated version of the libsoup and libsoup-devel packages, specifically version 2.62.3-14.el8_10.
If immediate updates are not possible, consider using VPNs or other secure methods to encrypt your network traffic as a temporary measure to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for libsoup.
