8.2

CVE-2026-5119: gnome libsoup

CVSS: 8.2v3.1HighModified
AliasesRHSA-2026:13978RHSA-2026:14087RHSA-2026:19356
Published 30-03-2026Last modified 09-06-2026
Open JSON

Vulnerability summary

CVE-2026-5119 is a high (CVSS 8.2) vulnerability in gnome libsoup. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.9% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
43/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.2/10
010
High · v3.1 (NVD)
EPSS score
0.25%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 5 · Related 2
RHSA-2026:15968RHSA-2026:17482RHSA-2026:19143USN-8523-1USN-8890-1

Timeline

  1. 30-03-2026
    PublishedVulnerability first disclosed.
  2. 09-06-2026
    Last modifiedVulnerability information updated.

Description

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.25%

Chance of exploitation in the next 30 days

Percentile

16%

Versus all other CVEs

30-day change

0.00 pp

From 0.25% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.25%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (gitlab.gnome.org)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Redhat5 products
  • enterprise_linuxEOL7.0 | 8.0 | 9.0 | 10.0
  • libsoup< 0:2.72.0-12.el9_7.6 | < 0:2.62.3-14.el8_10 | < 0:2.72.0-16.el9_8.1 | < 0:2.72.0-8.el9_0.10 | < 0:2.72.0-8.el9_2.11 | < 0:2.72.0-10.el9_6.7 | < 0:2.72.0-8.el9_4.10 | < 0:2.62.3-3.el8_8.9 | < 0:2.62.3-2.el8_4.9 | < 0:2.62.3-2.el8_6.9 | < 0:2.62.2-12.el7_9
  • libsoup-debuginfo< 0:2.72.0-12.el9_7.6 | < 0:2.62.3-14.el8_10 | < 0:2.72.0-16.el9_8.1 | < 0:2.72.0-8.el9_0.10 | < 0:2.72.0-8.el9_2.11 | < 0:2.72.0-10.el9_6.7 | < 0:2.72.0-8.el9_4.10 | < 0:2.62.3-3.el8_8.9 | < 0:2.62.3-2.el8_4.9 | < 0:2.62.3-2.el8_6.9 | < 0:2.62.2-12.el7_9
  • libsoup-debugsource< 0:2.72.0-12.el9_7.6 | < 0:2.62.3-14.el8_10 | < 0:2.72.0-16.el9_8.1 | < 0:2.72.0-8.el9_0.10 | < 0:2.72.0-8.el9_2.11 | < 0:2.72.0-10.el9_6.7 | < 0:2.72.0-8.el9_4.10 | < 0:2.62.3-3.el8_8.9 | < 0:2.62.3-2.el8_4.9 | < 0:2.62.3-2.el8_6.9
  • libsoup-devel< 0:2.72.0-12.el9_7.6 | < 0:2.62.3-14.el8_10 | < 0:2.72.0-16.el9_8.1 | < 0:2.72.0-8.el9_0.10 | < 0:2.72.0-8.el9_2.11 | < 0:2.72.0-10.el9_6.7 | < 0:2.72.0-8.el9_4.10 | < 0:2.62.3-3.el8_8.9 | < 0:2.62.3-2.el8_4.9 | < 0:2.62.3-2.el8_6.9 | < 0:2.62.2-12.el7_9
Debian2 products
  • libsoup2.4All versions (No fix recorded)
  • libsoup3All versions (No fix recorded) | < 3.8.0-1
Ubuntu2 products
  • libsoup2.4< 2.52.2-1ubuntu0.3+esm6 | < 2.62.1-1ubuntu0.4+esm7 | < 2.70.0-1ubuntu0.5+esm2 | < 2.74.2-3ubuntu0.7 | < 2.74.3-6ubuntu1.7 | < 2.74.3-10.1ubuntu4.1 | All versions (No fix recorded) | < 2.74.3-10.1ubuntu5+esm1
  • libsoup3< 3.0.7-0ubuntu1+esm9 | < 3.4.4-5ubuntu0.9 | All versions (No fix recorded) | < 3.6.6-1ubuntu0.1
Gnome1 product

4 vendors · 10 products

References

35 links
Show all 35 references