CVE-2026-66339

Description

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.

Traduire en français

Produits concernés

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Gnome libsoup
• Redhat enterprise linux

Scores CVSS

Faiblesses (CWE)

• CWE-201

Références

• https://access.redhat.com/security/cve/CVE-2026-66339 Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2506951 Issue TrackingVendor AdvisoryExploitMitigation

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories