Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

libsoup may send old proxy passwords to new proxy

published 2 days ago

Summary

The libsoup library used in OpenEuler can keep proxy login details and mistakenly forward them to a different proxy when the proxy settings change. This could expose usernames and passwords to an unintended server. Apply the latest libsoup security update to stop the credential leak.

What to do

Update openeuler libsoup to version 2.74.2-25.oe2203sp4.

Affected software

Ecosystem	Vendor	Product	Affected versions
openEuler:22.03-LTS-SP4	openeuler	libsoup	< 2.74.2-25.oe2203sp4 Fix: upgrade to 2.74.2-25.oe2203sp4

Original advisory text

libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.

Security Fix(es):

SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.(CVE-2026-12547)

References

https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-12547 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

3.4 Low

Timeline

Published16 Oct 2026

Updated16 Oct 2026

First seen16 Oct 2026

Sources

OESA-2026-4388 · OSV

Track software like this

Free during beta