The vulnerability CVE-2026-5119 affects the libsoup HTTP client and server library in Red Hat Enterprise Linux 8 and 9. When HTTPS tunnels are established through an HTTP proxy, sensitive session cookies are sent in cleartext in the initial HTTP CONNECT request. This cleartext transmission can be intercepted by attackers positioned on the network or by malicious HTTP proxies, exposing session cookies and enabling potential session hijacking or user impersonation. Red Hat has issued security advisories RHSA-2026:13978 and RHSA-2026:14087 providing updated libsoup packages that fix this information disclosure flaw.

The vulnerability leads to the disclosure of sensitive session cookies during HTTPS tunnel establishment via an HTTP proxy. This exposure can allow attackers with network access or control over the HTTP proxy to intercept session cookies, potentially enabling session hijacking or user impersonation. The CVSS score of 5.9 reflects a moderate impact with high confidentiality impact, low integrity impact, and no availability impact.

Red Hat has released official security updates for libsoup in Red Hat Enterprise Linux 8 and 9 that address CVE-2026-5119. Users should apply these updates promptly to remediate the vulnerability. Detailed update instructions are available at https://access.redhat.com/articles/11258. Since this is an official fix, applying the vendor-provided patches is the recommended mitigation. No additional mitigation steps are specified by the vendor advisory.