CVE-2026-66339CWE-201

CVE-2026-66339

Medium · published July 25, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
15.3
In the wild
Unconfirmed
What it is

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00249 · 15.3th percentile
Weakness
CWE-201 · Insertion of Sensitive Information Into Sent Data
Published
2026-07-25T03:16Z
Affected products (6)
ProductVersionsFixed in
gnome/libsoupall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
References (2)
https://access.redhat.com/security/cve/CVE-2026-66339 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2506951 · [email protected]
EPSS history
Timeline
  • 24 JUL 23:01Z
    Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels
    cvelistv5