CVE-2026-5119CWE-319

Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment

Medium · published March 30, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
16.0
In the wild
Unconfirmed
What it is

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00254 · 16.0th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2026-03-30T05:35Z
EPSS history
Timeline
  • 30 MAR 05:35Z
    Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment
    cvelistv5