CVE catalog

CVE-2026-66339

Severity: High · CVSS 7.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Published: Jun 5, 2026, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.25% · Oct 25, 2026

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libsoup3	sid	`3.8.0-3`	fixed
Debian	libsoup3	forky	`3.8.0-3`	fixed
Debian	libsoup3	trixie	`3.6.5-3`	vulnerable
Debian	libsoup3	bookworm	`3.2.3-0+deb12u2`	vulnerable
Debian	libsoup2.4	trixie	`2.74.3-10.1`	vulnerable
Debian	libsoup2.4	bookworm	`2.74.3-1+deb12u1`	vulnerable
Cpe	libsoup	Not reported	Not reported	unknown
Cpe	enterprise_linux	Not reported	Not reported	unknown
Ubuntu	libsoup2.4	noble	`2.74.3-6ubuntu1.9`	fixed
Ubuntu	libsoup3	noble	`3.4.4-5ubuntu0.9`	fixed
Ubuntu	gir1.2-soup-2.4	noble	`2.74.3-6ubuntu1.9`	fixed
Ubuntu	gir1.2-soup-3.0	noble	`3.4.4-5ubuntu0.9`	fixed
Ubuntu	libsoup-2.4-1	noble	`2.74.3-6ubuntu1.9`	fixed
Ubuntu	libsoup-3.0-0	noble	`3.4.4-5ubuntu0.9`	fixed
Ubuntu	libsoup-3.0-common	noble	`3.4.4-5ubuntu0.9`	fixed
Ubuntu	libsoup-3.0-dev	noble	`3.4.4-5ubuntu0.9`	fixed
Ubuntu	libsoup-3.0-doc	noble	`3.4.4-5ubuntu0.9`	fixed
Ubuntu	libsoup-3.0-tests	noble	`3.4.4-5ubuntu0.9`	fixed
Ubuntu	libsoup-gnome-2.4-1	noble	`2.74.3-6ubuntu1.9`	fixed
Ubuntu	libsoup-gnome2.4-dev	noble	`2.74.3-6ubuntu1.9`	fixed
Ubuntu	libsoup2.4-common	noble	`2.74.3-6ubuntu1.9`	fixed
Ubuntu	libsoup2.4-dev	noble	`2.74.3-6ubuntu1.9`	fixed
Ubuntu	libsoup2.4-doc	noble	`2.74.3-6ubuntu1.9`	fixed
Ubuntu	libsoup2.4-tests	noble	`2.74.3-6ubuntu1.9`	fixed
Ubuntu	libsoup2.4	pro	`2.74.3-10.1ubuntu4`	vulnerable
Ubuntu	libsoup2.4	pro	`2.74.3-10.1ubuntu5`	vulnerable
Ubuntu	libsoup2.4	pro	`2.74.3-10.1ubuntu5+esm1`	vulnerable
Ubuntu	libsoup2.4	pro	`2.74.3-10.1ubuntu5+esm2`	vulnerable
Ubuntu	libsoup2.4	pro	`2.74.3-10.1ubuntu5+esm3`	fixed
Ubuntu	libsoup2.4	22.04	`2.72.0-3ubuntu3`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.1-1`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-2`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.1`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.2`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.3`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.4`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.5`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.6`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.7`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.8`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.9`	fixed
Ubuntu	libsoup3	pro	`3.0.4-2`	vulnerable
Ubuntu	libsoup3	pro	`3.0.4-3`	vulnerable
Ubuntu	libsoup3	pro	`3.0.5-1`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1+esm1`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1+esm2`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1+esm3`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1+esm4`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1+esm5`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1+esm6`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1+esm7`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1+esm8`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1+esm9`	fixed
Ubuntu	libsoup2.4	24.04	`2.74.3-1`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-2`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-3`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6build1`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.1`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.2`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.3`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.4`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.5`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.6`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.7`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.8`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.9`	fixed
Ubuntu	libsoup3	24.04	`3.4.2-4`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-1`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-2`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-4`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5build1`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5build2`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5ubuntu0.1`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5ubuntu0.2`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5ubuntu0.3`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5ubuntu0.4`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5ubuntu0.5`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5ubuntu0.6`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5ubuntu0.7`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5ubuntu0.8`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5ubuntu0.9`	fixed
Ubuntu	libsoup2.4	26.10	`2.74.3-10.1ubuntu5`	vulnerable
Ubuntu	libsoup3	26.10	`3.6.6-1`	vulnerable
Ubuntu	libsoup3	26.10	`3.6.6-1ubuntu3`	fixed
Ubuntu	libsoup3	26.04	`3.6.5-4`	vulnerable
Ubuntu	libsoup3	26.04	`3.6.5-5`	vulnerable
Ubuntu	libsoup3	26.04	`3.6.5-6`	vulnerable
Ubuntu	libsoup3	26.04	`3.6.5-7`	vulnerable
Ubuntu	libsoup3	26.04	`3.6.5-9`	vulnerable
Ubuntu	libsoup3	26.04	`3.6.6-1`	vulnerable
Ubuntu	libsoup3	26.04	`3.6.6-1ubuntu0.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libsoup3	source	sid	`3.8.0-1`	not yet assigned	Not reported	[1142846]
Debian	libsoup3	source	forky	`3.8.0-1`	not yet assigned	Not reported	[1142846]
Debian	libsoup3	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1142846]
Debian	libsoup3	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1142846]
Debian	libsoup2.4	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	libsoup2.4	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported
Ubuntu	libsoup2.4	deb	noble	`2.74.3-6ubuntu1.9`	Not reported	Not reported	Not reported
Ubuntu	libsoup3	deb	noble	`3.4.4-5ubuntu0.9`	Not reported	Not reported	Not reported
Ubuntu	gir1.2-soup-2.4	deb	noble	`2.74.3-6ubuntu1.9`	Not reported	Not reported	Not reported
Ubuntu	gir1.2-soup-3.0	deb	noble	`3.4.4-5ubuntu0.9`	Not reported	Not reported	Not reported
Ubuntu	libsoup-2.4-1	deb	noble	`2.74.3-6ubuntu1.9`	Not reported	Not reported	Not reported
Ubuntu	libsoup-3.0-0	deb	noble	`3.4.4-5ubuntu0.9`	Not reported	Not reported	Not reported
Ubuntu	libsoup-3.0-common	deb	noble	`3.4.4-5ubuntu0.9`	Not reported	Not reported	Not reported
Ubuntu	libsoup-3.0-dev	deb	noble	`3.4.4-5ubuntu0.9`	Not reported	Not reported	Not reported
Ubuntu	libsoup-3.0-doc	deb	noble	`3.4.4-5ubuntu0.9`	Not reported	Not reported	Not reported
Ubuntu	libsoup-3.0-tests	deb	noble	`3.4.4-5ubuntu0.9`	Not reported	Not reported	Not reported
Ubuntu	libsoup-gnome-2.4-1	deb	noble	`2.74.3-6ubuntu1.9`	Not reported	Not reported	Not reported
Ubuntu	libsoup-gnome2.4-dev	deb	noble	`2.74.3-6ubuntu1.9`	Not reported	Not reported	Not reported
Ubuntu	libsoup2.4-common	deb	noble	`2.74.3-6ubuntu1.9`	Not reported	Not reported	Not reported
Ubuntu	libsoup2.4-dev	deb	noble	`2.74.3-6ubuntu1.9`	Not reported	Not reported	Not reported
Ubuntu	libsoup2.4-doc	deb	noble	`2.74.3-6ubuntu1.9`	Not reported	Not reported	Not reported
Ubuntu	libsoup2.4-tests	deb	noble	`2.74.3-6ubuntu1.9`	Not reported	Not reported	Not reported
Ubuntu	libsoup2.4	deb	pro	`2.74.3-10.1ubuntu5+esm3`	Not reported	UBUNTU-CVE-2026-66339	Not reported
Ubuntu	libsoup2.4	deb	22.04	`2.74.2-3ubuntu0.9`	Not reported	UBUNTU-CVE-2026-66339	Not reported
Ubuntu	libsoup3	deb	pro	`3.0.7-0ubuntu1+esm9`	Not reported	UBUNTU-CVE-2026-66339	Not reported
Ubuntu	libsoup2.4	deb	24.04	`2.74.3-6ubuntu1.9`	Not reported	UBUNTU-CVE-2026-66339	Not reported
Ubuntu	libsoup3	deb	24.04	`3.4.4-5ubuntu0.9`	Not reported	UBUNTU-CVE-2026-66339	Not reported
Ubuntu	libsoup3	deb	26.10	`3.6.6-1ubuntu3`	Not reported	UBUNTU-CVE-2026-66339	Not reported
Ubuntu	libsoup3	deb	26.04	`3.6.6-1ubuntu0.1`	Not reported	UBUNTU-CVE-2026-66339	Not reported

[Debian bug #1142846]

Notes

[trixie] libsoup3: Minor issue [bookworm] libsoup3: Minor issue [trixie] libsoup2.4: Minor issue [bookworm] libsoup2.4: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[gir1.2-soup-2.4]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
[gir1.2-soup-3.0]Affected
Source package: [libsoup3]
Details (2)
- 3.2.3-0+deb12u2 · amd64 · bookworm
  Affected
  nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12
- 3.2.3-0+deb12u2 · arm64 · bookworm
  Affected
  nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12
[libsoup2.4-1]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
[libsoup2.4-common]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · all · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · all · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
[libsoup2.4-dev]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
[libsoup2.4-doc]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · all · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · all · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
[libsoup2.4-tests]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
[libsoup-3.0-0]Affected
Source package: [libsoup3]
Details (2)
- 3.2.3-0+deb12u2 · amd64 · bookworm
  Affected
  nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12
- 3.2.3-0+deb12u2 · arm64 · bookworm
  Affected
  nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12
[libsoup-3.0-common]Affected
Source package: [libsoup3]
Details (2)
- 3.2.3-0+deb12u2 · all · bookworm
  Affected
  nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12
- 3.2.3-0+deb12u2 · all · bookworm
  Affected
  nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12
[libsoup-3.0-dev]Affected
Source package: [libsoup3]
Details (2)
- 3.2.3-0+deb12u2 · amd64 · bookworm
  Affected
  nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12
- 3.2.3-0+deb12u2 · arm64 · bookworm
  Affected
  nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12
[libsoup-3.0-doc]Affected
Source package: [libsoup3]
Details (2)
- 3.2.3-0+deb12u2 · all · bookworm
  Affected
  nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12
- 3.2.3-0+deb12u2 · all · bookworm
  Affected
  nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12
[libsoup-3.0-tests]Affected
Source package: [libsoup3]
Details (2)
- 3.2.3-0+deb12u2 · amd64 · bookworm
  Affected
  nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12
- 3.2.3-0+deb12u2 · arm64 · bookworm
  Affected
  nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12
[libsoup-gnome2.4-1]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
[libsoup-gnome2.4-dev]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

[Debian 13 (Trixie)]

[gir1.2-soup-2.4]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-10.1 · amd64 · trixie
  Affected
  nvd · libsoup2.4 · debian · 13
- 2.74.3-10.1 · arm64 · trixie
  Affected
  nvd · libsoup2.4 · debian · 13
[gir1.2-soup-3.0]Affected
Source package: [libsoup3]
Details (2)
- 3.6.5-3 · amd64 · trixie
  Affected
  nvd · libsoup3 · debian · 13
- 3.6.5-3 · arm64 · trixie
  Affected
  nvd · libsoup3 · debian · 13
[libsoup-2.4-1]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-10.1 · amd64 · trixie
  Affected
  nvd · libsoup2.4 · debian · 13
- 2.74.3-10.1 · arm64 · trixie
  Affected
  nvd · libsoup2.4 · debian · 13
[libsoup2.4-common]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-10.1 · all · trixie
  Affected
  nvd · libsoup2.4 · debian · 13
- 2.74.3-10.1 · all · trixie
  Affected
  nvd · libsoup2.4 · debian · 13
[libsoup2.4-dev]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-10.1 · amd64 · trixie
  Affected
  nvd · libsoup2.4 · debian · 13
- 2.74.3-10.1 · arm64 · trixie
  Affected
  nvd · libsoup2.4 · debian · 13
[libsoup2.4-doc]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-10.1 · all · trixie
  Affected
  nvd · libsoup2.4 · debian · 13
- 2.74.3-10.1 · all · trixie
  Affected
  nvd · libsoup2.4 · debian · 13

Next results

Observed: Oct 23, 2026, 9:43:28 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]