The vulnerability CVE-2026-5119 affects the libsoup HTTP client and server library in Red Hat Enterprise Linux 8 and 9. When HTTPS tunnels are established via a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. This exposure can be exploited by attackers positioned on the network or by malicious HTTP proxies to intercept cookies, risking session hijacking or impersonation. Red Hat has issued security advisories RHSA-2026:13978 for RHEL 9 and RHSA-2026:14087 for RHEL 8, providing updated libsoup packages that fix this information disclosure vulnerability.

The vulnerability allows disclosure of sensitive session cookies in cleartext during HTTPS tunnel establishment through an HTTP proxy. This can enable attackers with network access or control over the proxy to intercept these cookies, potentially leading to session hijacking or user impersonation. The CVSS v3.1 base score is 5.9 (medium severity), reflecting network attack vector, high attack complexity, no privileges required, user interaction required, and high confidentiality impact with low integrity impact.

Red Hat has released official security updates for libsoup in Red Hat Enterprise Linux 8 and 9 that address CVE-2026-5119. Users should apply the provided patches as detailed in Red Hat advisories RHSA-2026:13978 (RHEL 9) and RHSA-2026:14087 (RHEL 8). Instructions for applying these updates are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.