CVE-2026-66339

תיאור (מקור, אנגלית)

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.

מדדים

CVSS 3.1

6.5 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE

CWE-201

קישורים

• https://access.redhat.com/security/cve/CVE-2026-66339
• https://bugzilla.redhat.com/show_bug.cgi?id=2506951