Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
Libsoup Cookie Data Leaked Over HTTPS
published 6 months ago
Summary
Libsoup, a library used in GNOME, has a security issue where sensitive cookie data can be exposed when connecting to a website over a secure connection. This could potentially allow an attacker to steal user credentials or sensitive information. Update to the latest version of libsoup to fix this issue.
What to do
- Update rocky libsoup to version 0:2.72.0-12.el9_7.6.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Rocky Linux:9 | rocky | libsoup |
< 0:2.72.0-12.el9_7.6 Fix: upgrade to 0:2.72.0-12.el9_7.6
|
Original advisory text
Moderate: libsoup security update
The libsoup packages provide an HTTP client and server library for GNOME.
Security Fix(es):
* libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://errata.rockylinux.org/RLSA-2026:13978 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2452932 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published7 May 2026
Updated7 May 2026
First seen7 May 2026
Sources
RLSA-2026:13978 · OSV
Track software like this
Free during beta