CVE-2026-5119HIGH 5.9EPSS p16.5%

CVE-2026-5119CVE-2026-5119

gnome / libsoup

Description

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.

Scoring

CVSS 3.15.9 (HIGH)
VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
EPSS0.25% probability of exploitation · percentile 16.5% · 2026-06-19T12:03:05Z
Published2026-03-30
Last modified2026-06-09

Underlying weaknesses· 1

CWE-319

References

  1. https://access.redhat.com/errata/RHSA-2026:13978
  2. https://access.redhat.com/errata/RHSA-2026:14087
  3. https://access.redhat.com/errata/RHSA-2026:15968
  4. https://access.redhat.com/errata/RHSA-2026:17482
  5. https://access.redhat.com/errata/RHSA-2026:19143
  6. https://access.redhat.com/errata/RHSA-2026:19356
  7. https://access.redhat.com/security/cve/CVE-2026-5119
  8. https://bugzilla.redhat.com/show_bug.cgi?id=2452932

1

TypeTargetConfidenceTier
WeaknessCleartext Transmission of Sensitive Informationcwe-3190%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-2436
CVE
CVE-2025-14523
CVE
CVE-2026-1761
CVE
CVE-2026-2369
CVE
CVE-2026-1502
CVE
CVE-2025-32911
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.