CVE-2026-5119

A flaw was found in libsoup

Risk score: 67/100
CVSS: 8.2 v3.1
Exploit chance (30 days): 0.3%
Published: 30 Mar 2026

Open in the live forecast Today's forecast

What to know

What it is: A flaw in libsoup allows sensitive session cookies to be intercepted by an attacker when establishing HTTPS tunnels through a configured HTTP proxy, leading to potential session hijacking or user impersonation.
Affected: {'product': 'libsoup', 'vendor': 'gnome'}
Fix: Check the linked advisory for a fix, as none is specified in this record.
Exploitation: Public proof of concept

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Gnome Libsoup: Amber, patch this week. A Use-After-Free vulnerability in libsoup's HTTP/2 server implementation allows a remote attacker to cause application instability or crashes, resulting in a Denial of Service (DoS), by sending specially crafted HTTP/2 requests.

The flaws

CVE-2026-5119: A flaw was found in libsoup (CVSS 8.2 · EPSS 0%)
CVE-2026-4271: Use-after-free can lead to denial of service (CVSS 7.5 · EPSS 1%)
CVE-2026-102560: Out-of-bounds read (CVSS 9.8 · EPSS 0%)
CVE-2026-102559: Out-of-bounds read (CVSS 8.6 · EPSS 0%)

The fix

Fix: Check the linked advisory for details on the fix.

Who is exposed: {'products': ['libsoup'], 'packages': [], 'versions': []}

Where it stands

Public proof of concept

How it unfolded

21 Oct, Ubuntu security notices (official): USN-8890-2: libsoup vulnerabilities

Connects to

Same weakness: CWE-319 (CWE-319). 17 other warnings in 30 days
Same product: Earlier Gnome Libsoup warnings. 5 in the last 90 days

Why it is Amber

CVSS 8.2 high
Public exploit or proof of concept referenced
Remotely exploitable without logging in
Named in a government or vendor bulletin

Government and vendor bulletins

USN-8890-2: libsoup vulnerabilities

References

Original description

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.

Last activity 21 Oct 2026. Patch Forecast updates every hour.