Information Disclosure in libsoup via Proxy Authorization Header Mismanagement
CVE-2026-66339

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
24 July 2026

What is CVE-2026-66339?

A vulnerability exists in libsoup where it improperly handles the Proxy-Authorization header after establishing a CONNECT tunnel through an HTTP proxy. This flaw allows sensitive information such as proxy credentials to be sent to the destination server via subsequent HTTPS requests, potentially leading to unauthorized access to critical data and increased risk of security breaches.

References

https://access.redhat.com/security/cve/CVE-2026-66339
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2506951
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Upstream acknowledges cavid as the original reporter.
.