PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-5119 Redhat CVE debrief

CVE-2026-5119 describes a cleartext transmission issue in libsoup during HTTPS tunneling through an HTTP proxy. In the initial HTTP CONNECT request, sensitive session cookies may be exposed before the tunnel is established. A network-positioned attacker or a malicious proxy could intercept those cookies and potentially reuse them for session hijacking or user impersonation.

Vendor
Redhat
Product
Unknown
CVSS
MEDIUM 5.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-30
Original CVE updated
2026-06-09
Advisory published
2026-03-30
Advisory updated
2026-06-09

Who should care

Operators and developers who use libsoup behind HTTP proxies, especially in environments where HTTPS traffic is tunneled through a proxy and session cookies are present. Red Hat Enterprise Linux deployments with affected libsoup packages should review the linked advisories.

Technical summary

The NVD record and Red Hat references describe a CWE-319 weakness: sensitive cookies are transmitted in cleartext in the initial proxy CONNECT request used to establish an HTTPS tunnel. The CVSS v3.1 vector is AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N, reflecting network reachability, required user interaction, high confidentiality impact, and low integrity impact. The issue is relevant wherever libsoup is configured to use an HTTP proxy for HTTPS connections.

Defensive priority

Medium overall based on the 5.9 CVSS score, but higher priority if your environment uses HTTP proxies for HTTPS and relies on session cookies. Focus on proxy-heavy deployments, shared networks, and any system where cookie exposure could lead to account compromise.

Recommended defensive actions

  • Review whether any applications or systems use libsoup with an HTTP proxy for HTTPS tunneling.
  • Apply the relevant Red Hat advisories referenced in the NVD record: RHSA-2026:13978, RHSA-2026:14087, and RHSA-2026:15968.
  • Check the Red Hat CVE page and Bugzilla reference for package-specific remediation guidance.
  • Reduce exposure by avoiding unnecessary HTTP proxy use for sensitive HTTPS sessions where feasible.
  • Treat intercepted session cookies as compromised if proxy-side or network interception is suspected.

Evidence notes

Derived from the supplied NVD record and Red Hat-linked references only. Key evidence includes the CVE description, CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N, weakness CWE-319, and the Red Hat advisory links embedded in the source item. No additional facts were inferred beyond the provided corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-5119 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-5119

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-5119 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-5119

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.