CVE-2026-66339

Received Received - Intake

libsoup Proxy-Authorization Header Information Disclosure

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: Red Hat, Inc.

Description

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-24

Last Modified

2026-07-24

Generated

2026-07-25

AI Q&A

2026-07-25

EPSS Evaluated

N/A

NVD

CVE-2026-66339

EUVD

EUVD-2026-48751

Affected Vendors & Products

Vendor	Product	Version / Range
gnome	libsoup	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-201	The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

Executive Summary

This vulnerability is in libsoup, a library for HTTP requests. When an HTTP proxy is used to create a CONNECT tunnel, the Proxy-Authorization header is incorrectly attached to later HTTPS requests sent through that tunnel. This lets the destination server access proxy credentials, exposing sensitive information.

Detection Guidance

To detect this vulnerability, inspect network traffic for HTTPS requests containing the Proxy-Authorization header after establishing an HTTP CONNECT tunnel. Use tools like tcpdump or Wireshark to capture and analyze packets for unauthorized header inclusion. Check proxy and server logs for suspicious header forwarding.

Impact Analysis

If you use an HTTP proxy with libsoup, attackers could intercept proxy credentials. This may lead to unauthorized access to internal systems or data breaches if proxy credentials grant access to sensitive resources.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) by exposing credentials that may allow access to protected information.

Mitigation Strategies

Update libsoup to the latest patched version to fix the Proxy-Authorization header flaw. Monitor network traffic for unexpected Proxy-Authorization headers in HTTPS requests. Disable CONNECT tunnel usage if not required.

Hi! I’m here to help you understand CVE-2026-66339. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70