CVE-2026-66339
Gnome Libsoup: information disclosure
- Risk score
- 52/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 24 Jul 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information …
- Affected
- Gnome Libsoup
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- Public proof of concept
Story map
At a glance
Gnome Libsoup: Amber, patch this week. A Use-After-Free vulnerability in libsoup's HTTP/2 server implementation allows a remote attacker to cause application instability or crashes, resulting in a Denial of Service (DoS), by sending specially crafted HTTP/2 requests.
The flaws
- CVE-2026-66339: Information disclosure (CVSS 6.5 · EPSS 0%)
- CVE-2026-4271: Use-after-free can lead to denial of service (CVSS 7.5 · EPSS 1%)
- CVE-2026-102560: Out-of-bounds read (CVSS 9.8 · EPSS 0%)
- CVE-2026-5119: A flaw was found in libsoup (CVSS 8.2 · EPSS 0%)
The fix
Fix: Check the linked advisory for details on the fix.
Who is exposed: {'products': ['libsoup'], 'packages': [], 'versions': []}
Where it stands
- Public proof of concept
How it unfolded
- 21 Oct, Ubuntu security notices (official): USN-8890-2: libsoup vulnerabilities
Connects to
- Same weakness: CWE-201 (CWE-201). 39 other warnings in 30 days
- Same product: Earlier Gnome Libsoup warnings. 5 in the last 90 days
Why it is Yellow
- CVSS 6.5 medium
- Public exploit or proof of concept referenced
- Named in a government or vendor bulletin
Government and vendor bulletins
References
Original description
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.
Last activity 21 Oct 2026. Patch Forecast updates every hour.