Moderate Security Update for libsoup: Addressing Information Disclosure Vulnerability
Summary
ALSA-2026:19356: Moderate: libsoup security update. Affects libsoup versions < 2.72.0-16.el9_8.1. Fixed in 2.72.0-16.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libsoup is an HTTP client and server library designed for the GNOME desktop environment. It facilitates the development of applications that require network communication, providing a robust framework for handling HTTP requests and responses. However, recent findings have revealed a vulnerability that compromises the security of cookie transmissions during HTTPS tunnel establishment, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability identified as CVE-2026-5119 allows for information disclosure through the cleartext transmission of cookies when establishing HTTPS tunnels. This issue arises from the improper handling of cookie data, which can be intercepted by malicious actors during the transmission process. The ramifications of this vulnerability include the potential for unauthorized access to user sessions and sensitive data, posing significant risks to user privacy and application security.
How To Fix
Minimum fixed version
2.72.0-16.el9_8.1
This is the first release that contains the fix.
sudo dnf update libsoupTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional encryption layers or using alternative methods for cookie handling during HTTPS tunnel establishment until the update can be applied. However, this is not a substitute for applying the official patch.
Conclusion
The libsoup library has a moderate security vulnerability (CVE-2026-5119) that can lead to information disclosure through the cleartext transmission of cookies. It is crucial for users to update to the latest patched version to safeguard their applications and user data. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libsoup →
FAQ
CVE-2026-5119 is a vulnerability in the libsoup library that allows for the cleartext transmission of cookies during HTTPS tunnel establishment, leading to potential information disclosure.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary risk is the potential for unauthorized access to user sessions and sensitive data, which can lead to privacy breaches and security incidents.
Yes, a patch is available. Users should update to libsoup version 2.72.0-16.el9_8.1 or later to mitigate the vulnerability.
If you cannot apply the update immediately, consider implementing additional security measures, such as enhanced encryption for cookie handling, as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for libsoup.
