CVE-2026-5119: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-5119 is an information disclosure vulnerability in GNOME libsoup, the HTTP client/server library used widely in GNOME-based applications. The flaw causes sensitive session cookies to be transmitted in cleartext within the initial HTTP CONNECT request when establishing HTTPS tunnels through a configured HTTP proxy, enabling interception by a network-positioned attacker or malicious proxy. It was disclosed on March 30, 2026, and affects GNOME libsoup (all versions tracked under cpe:2.3:a:gnome:libsoup) as well as Red Hat Enterprise Linux 7, 8, 9, and 10. The CVSS v3.1 base score is 8.2 (High) per Feedly/NVD aggregation, though the GitHub Advisory Database and ENISA score it at 5.9 (Medium) using a stricter vector requiring user interaction and high attack complexity (Red Hat CVE, GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-319 (Cleartext Transmission of Sensitive Information). The flaw resides in libsoup's soup_session.c::tunnel_connect() function, which handles HTTPS tunnel establishment via HTTP proxies. When a client application using libsoup is configured to route HTTPS traffic through an HTTP proxy, the library sends the HTTP CONNECT request — including any attached cookies — in plaintext before the TLS tunnel is established. An attacker positioned on the network path between the client and the proxy, or a malicious proxy itself, can passively observe or actively intercept the cleartext HTTP CONNECT request and extract the session cookies contained within it. No authentication or special privileges are required for exploitation; the attacker only needs network visibility of the proxy communication channel (Red Hat Bugzilla, GitHub Advisory, GNOME GitLab Issue).

Successful exploitation allows a network-positioned attacker or malicious HTTP proxy to intercept session cookies transmitted in cleartext, leading to session hijacking and user impersonation. The primary impact is high confidentiality loss (exposure of authentication tokens), with a low integrity impact due to the ability to act as the impersonated user. Availability is not affected. Any application using libsoup with an HTTP proxy configuration and session-based authentication is at risk, including GNOME desktop applications, GNOME Online Accounts, and other software linking against the library on affected Linux distributions (Red Hat CVE, GitHub Advisory).

No confirmed weaponized exploit or public proof-of-concept code is available as of the latest data; the GNOME GitLab issue tracker entry (issue #502) was assessed as non-exploitable based on available content. The EPSS score is approximately 0.02% (4th percentile), indicating a low near-term exploitation probability. Exploitation has been reported by some sources (e.g., linuxcompatible.org), but no threat actor attribution or CISA KEV catalog listing has been identified. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Red Hat Bugzilla).

1. Identify target environment: Determine that the target system runs an application using libsoup (e.g., a GNOME desktop app or service) configured to use an HTTP proxy for outbound HTTPS connections.
2. Position on network path: Gain a network-adjacent position between the client and the configured HTTP proxy — for example, via ARP spoofing on a local network, BGP hijacking, or by operating a malicious/compromised HTTP proxy.
3. Capture HTTP CONNECT traffic: Use a packet capture tool (e.g., tcpdump, Wireshark) or proxy logging to intercept plaintext HTTP CONNECT requests sent by the libsoup client before TLS tunnel establishment.
4. Extract session cookies: Parse the captured HTTP CONNECT request headers for Cookie: header values containing session tokens or authentication credentials transmitted in cleartext.
5. Replay cookies for session hijacking: Use the extracted cookies in crafted HTTP requests to the target web service to impersonate the victim user and gain unauthorized access to their session (Red Hat Bugzilla, GitHub Advisory).

• Network: Unexpected plaintext HTTP CONNECT requests containing Cookie: headers observed in proxy logs or network captures; HTTP CONNECT traffic to unusual or unauthorized proxy endpoints from GNOME/libsoup-based client systems.
• Logs: HTTP proxy access logs showing CONNECT requests with cookie headers attached prior to tunnel establishment; anomalous session activity (e.g., logins from unexpected IP addresses) following periods of proxy-routed HTTPS traffic.
• Process/Application: Applications using libsoup (e.g., GNOME Online Accounts, Evolution, GNOME Shell extensions) making outbound connections through a configured HTTP proxy while handling authenticated sessions.

Red Hat has released patched packages addressing CVE-2026-5119 across all affected RHEL versions. Key errata include:

• RHEL 9: libsoup-2.72.0-12.el9_7.6 via RHSA-2026:13978
• RHEL 8: libsoup-2.62.3-14.el8_10 via RHSA-2026:14087
• RHEL 10: via RHSA-2026:15968
• RHEL 7 ELS: via RHSA-2026:24722

Additional errata cover extended update support and SAP solutions variants. As a workaround where immediate patching is not possible, avoid configuring HTTP proxies for applications handling sensitive session cookies, or disable proxy settings for libsoup-based applications. Monitor network traffic for cookie-containing HTTP CONNECT requests (Red Hat Bugzilla, RHSA-2026:13978, RHSA-2026:14087).

Red Hat Product Security rated this vulnerability as Moderate severity and issued multiple errata across RHEL 7 through 10, including extended update support and SAP solutions variants, reflecting broad remediation coverage. The issue was originally filed in the GNOME GitLab issue tracker (issue #502) and tracked via Red Hat Bugzilla. Coverage has appeared in Linux-focused security outlets including linuxcompatible.org, linuxsecurity.com, and pro-linux.de, as well as Yocto Project security mailing lists, indicating awareness across the embedded and enterprise Linux communities (Red Hat CVE, GitHub Advisory).