CVE-2026-1539
Medium · 5.8CVSS
5.8
EPSS
0.3%
Published
Jan 28, 2026
CISA due date
—
The record
A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTTP redirects, libsoup removes the Authorization header but does not remove the Proxy-Authorization header if the request is redirected to a different host. As a result, sensitive proxy credentials may be leaked to third-party servers. Applications using libsoup for HTTP communication may unintentionally expose proxy authentication data.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | libsoup | 0 | 3.0.4-150400.3.37.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | libsoup | 0 | 3.0.4-150400.3.37.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | libsoup | 0 | 3.0.4-150400.3.37.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | libsoup | 0 | 3.0.4-150400.3.37.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise Micro 5.2 | libsoup | 0 | 2.68.4-150200.4.33.1 |
| SUSE:Linux Enterprise Micro 5.3 | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise Micro 5.4 | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise Micro 5.5 | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | libsoup | 0 | 3.4.4-150600.3.37.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | libsoup2 | 0 | 2.74.3-150600.4.30.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | libsoup | 0 | 2.62.2-5.37.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | libsoup | 0 | 3.0.4-150400.3.37.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | libsoup | 0 | 3.0.4-150400.3.37.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | libsoup | 0 | 3.4.4-150600.3.37.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | libsoup2 | 0 | 2.74.3-150600.4.30.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | libsoup | 0 | 2.62.2-5.37.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | libsoup | 0 | 3.0.4-150400.3.37.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | libsoup | 0 | 3.0.4-150400.3.37.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | libsoup2 | 0 | 2.74.2-150400.3.31.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | libsoup | 0 | 3.4.4-150600.3.37.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | libsoup2 | 0 | 2.74.3-150600.4.30.1 |
| openSUSE:Leap 15.6 | libsoup | 0 | 3.4.4-150600.3.37.1 |
| openSUSE:Leap 15.6 | libsoup2 | 0 | 2.74.3-150600.4.30.1 |
| openSUSE:Leap 16.0 | libsoup | 0 | 3.6.6-160000.1.1 |
| openSUSE:Leap 16.0 | libsoup2 | 0 | 2.74.3-160000.4.1 |
| openSUSE:Tumbleweed | libsoup | 0 | 3.6.6-2.1 |
| openSUSE:Tumbleweed | libsoup2 | 0 | 2.74.3-18.1 |
Related vulnerabilities
- CVE-2026-1760 A flaw was found in SoupServer. Also affects libsoup
- CVE-2026-1467 A flaw was found in libsoup, an HTTP client library. Also affects libsoup
- CVE-2024-52531 GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform… Also affects libsoup
- CVE-2024-52532 GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. Also affects libsoup
- CVE-2024-52530 GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because… Also affects libsoup
- CVE-2026-2708 A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. Also affects libsoup2
- CVE-2026-2369 A flaw was found in libsoup. Also affects libsoup2
- CVE-2026-2443 A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. Also affects libsoup2