CVE-2026-5119 Details

A vulnerability in Libsoup allows sensitive session cookies to be transmitted in cleartext through the initial HTTP CONNECT request when establishing HTTPS tunnels via a configured HTTP proxy. This flaw can be exploited by a network-positioned attacker or a malicious HTTP proxy to intercept these cookies, potentially leading to session hijacking or user impersonation. The issue affects Libsoup versions prior to the latest commit in February 2026.

Users can mitigate this vulnerability by ensuring that all HTTP proxies used for HTTPS tunnels are trusted and operate within a secure network. Avoid configuring applications to use untrusted HTTP proxies. If possible, bypass proxies for sensitive connections or use a secure proxy solution that encrypts the entire communication channel.