5.8

CVE-2026-1539: gnome libsoup

CVSS: 5.8v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2026-1539DEBIAN-CVE-2026-1539
Published 28-01-2026Last modified 25-03-2026
Open JSON

Vulnerability summary

CVE-2026-1539 is a medium (CVSS 5.8) vulnerability in gnome libsoup. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 18.9% of scored vulnerabilities.

Overall risk
23/100
0100
Low · default modelHow is this calculated?
CVSS score
5.8/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.28%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 17 · Related 17
OPENSUSE-SU-2026:10276-1OPENSUSE-SU-2026:10291-1OPENSUSE-SU-2026:20354-1OPENSUSE-SU-2026:20384-1SUSE-SU-2026:0788-1SUSE-SU-2026:0792-1

Timeline

  1. 28-01-2026
    PublishedVulnerability first disclosed.
  2. 25-03-2026
    Last modifiedVulnerability information updated.

Description

A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTTP redirects, libsoup removes the Authorization header but does not remove the Proxy-Authorization header if the request is redirected to a different host. As a result, sensitive proxy credentials may be leaked to third-party servers. Applications using libsoup for HTTP communication may unintentionally expose proxy authentication data.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.28%

Chance of exploitation in the next 30 days

Percentile

19%

Versus all other CVEs

30-day change

+0.02 pp

From 0.25% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.28%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Debian2 products
  • libsoup2.4All versions (No fix recorded)
  • libsoup3All versions (No fix recorded) | < 3.6.5-8
Ubuntu2 products
  • libsoup2.4< 2.52.2-1ubuntu0.3+esm7 | < 2.62.1-1ubuntu0.4+esm8 | < 2.70.0-1ubuntu0.5+esm3 | < 2.74.2-3ubuntu0.8 | < 2.74.3-6ubuntu1.8 | All versions (No fix recorded) | < 2.74.3-10.1ubuntu5+esm2
  • libsoup3< 3.0.7-0ubuntu1+esm7 | < 3.4.4-5ubuntu0.7 | < 3.6.5-4ubuntu0.2
Gnome1 product
Redhat1 product

4 vendors · 6 products

References

7 links