CVE-2026-5119: Gnome Libsoup Information Disclosure Flaw

CVE-2026-5119 Overview

A cleartext transmission vulnerability has been identified in GNOME libsoup, a widely-used HTTP client/server library for GNOME applications. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.

This vulnerability affects applications relying on libsoup for secure HTTP communications, particularly in enterprise environments where HTTP proxies are commonly deployed. The flaw undermines the confidentiality guarantees expected from HTTPS connections when proxy configurations are in use.

Critical Impact

Session cookies transmitted in cleartext during HTTPS tunnel establishment enable attackers to hijack user sessions and impersonate authenticated users without requiring credential theft.

Affected Products

• GNOME libsoup (all versions prior to patch)
• Red Hat Enterprise Linux 7.0
• Red Hat Enterprise Linux 8.0
• Red Hat Enterprise Linux 9.0
• Red Hat Enterprise Linux 10.0

Discovery Timeline

• 2026-03-30 - CVE-2026-5119 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-5119

Vulnerability Analysis

This vulnerability is classified as CWE-319 (Cleartext Transmission of Sensitive Information). The fundamental security issue lies in libsoup's handling of session cookies during the HTTP CONNECT handshake phase when establishing HTTPS tunnels through proxy servers.

When a client application using libsoup attempts to connect to an HTTPS endpoint through an HTTP proxy, the library initiates an HTTP CONNECT request to instruct the proxy to establish a tunnel. The vulnerability occurs because libsoup incorrectly includes session cookies in this initial CONNECT request, which is transmitted in plaintext before the TLS tunnel is established.

The attack can be executed by any entity positioned to observe network traffic between the client and the HTTP proxy, including malicious proxy operators, compromised network infrastructure, or attackers performing man-in-the-middle attacks on the initial proxy connection segment.

Root Cause

The root cause stems from improper cookie handling logic in libsoup's proxy connection code. The library fails to distinguish between requests that should carry authentication cookies (actual application requests sent through the established tunnel) and proxy negotiation requests (the CONNECT method used to establish the tunnel). This results in sensitive session identifiers being attached to the CONNECT request before any encryption is in place.

Attack Vector

The attack vector is network-based, requiring the attacker to have visibility into network traffic between the victim client and the HTTP proxy server. Attack scenarios include:

The vulnerability can be exploited by a malicious HTTP proxy operator who simply logs incoming CONNECT requests to harvest session cookies. Alternatively, an attacker with network access between the client and proxy can passively capture traffic to extract cookie values. Once obtained, these session cookies can be used to impersonate the victim user on the target HTTPS service.

Since the HTTP CONNECT request travels unencrypted to the proxy, any network observer in the path can capture the sensitive cookie headers. The attacker does not need to break TLS encryption as the vulnerability occurs before the encrypted tunnel is established.

Detection Methods for CVE-2026-5119

Indicators of Compromise

• Unexpected session activity from IP addresses not associated with legitimate users, indicating potential session hijacking
• Multiple concurrent sessions using the same session token from different geographic locations
• Anomalous authentication patterns where session cookies appear without corresponding login events
• Network traffic logs showing Cookie headers in HTTP CONNECT requests to proxy servers

Detection Strategies

• Deploy network monitoring to inspect HTTP CONNECT requests for the presence of Cookie headers, which should not normally be included
• Implement session analytics to detect session tokens being used from unusual networks or proxy exit points
• Configure intrusion detection systems to alert on cleartext transmission of known session cookie patterns
• Review proxy server logs for CONNECT requests containing authentication or session-related headers

Monitoring Recommendations

• Enable verbose logging on HTTP proxy servers to capture full request headers for security analysis
• Implement network traffic analysis at egress points to identify potential cookie leakage in proxy negotiations
• Monitor application session logs for signs of session hijacking such as session token reuse across disparate client contexts
• Establish baseline metrics for legitimate session behavior to identify anomalous access patterns

How to Mitigate CVE-2026-5119

Immediate Actions Required

• Update libsoup to the latest patched version as soon as vendor patches become available
• Review and audit all applications using libsoup that connect through HTTP proxies to assess exposure
• Consider temporarily disabling HTTP proxy usage for sensitive applications until patches are applied
• Implement additional session security measures such as IP binding or frequent token rotation

Patch Information

Security updates addressing this vulnerability are being tracked by Red Hat and GNOME. Administrators should consult the Red Hat CVE-2026-5119 Advisory for patch availability and deployment guidance. Additional technical details can be found in Red Hat Bug Report #2452932 and GNOME libsoup Issue #502.

For Red Hat Enterprise Linux systems, apply security updates via standard package management:

# Update libsoup package on RHEL systems
sudo dnf update libsoup --security

# Verify installed version after update
rpm -q libsoup

Workarounds

• Configure applications to use HTTPS proxies instead of HTTP proxies where possible, ensuring the entire proxy negotiation is encrypted
• Implement network segmentation to ensure proxy traffic traverses only trusted network segments
• Deploy short-lived session tokens with aggressive expiration to limit the window of exploitation
• Consider using alternative HTTP libraries without this vulnerability for critical applications until libsoup is patched

# Configuration example
# For GNOME applications, consider configuring HTTPS proxy instead of HTTP
# Set environment variables or system proxy settings to use secure proxy

export https_proxy="https://secure-proxy.example.com:8443"

# Alternatively, configure via gsettings for GNOME desktop
gsettings set org.gnome.system.proxy.https host 'secure-proxy.example.com'
gsettings set org.gnome.system.proxy.https port 8443