CVE-2026-66339 Details

A vulnerability exists in libsoup where, after establishing a CONNECT tunnel through an HTTP proxy, the Proxy-Authorization header is improperly added to subsequent HTTPS requests sent through that tunnel. This misstep allows the destination server to intercept proxy credentials, resulting in unauthorized information disclosure. The issue arises because the proxy authentication logic indiscriminately applies the Proxy-Authorization header to all outgoing requests, including those via an established CONNECT tunnel, contrary to HTTP standards which dictate that such headers should only be included in the initial CONNECT request.

Red Hat has deferred the fix for this vulnerability in all affected versions of libsoup across multiple Red Hat Enterprise Linux releases. Users should consult the Red Hat Security Response Team for guidance.