The libsoup package, which provides HTTP client and server functionality for GNOME, contains a vulnerability (CVE-2026-5119) that causes information disclosure by transmitting cookies in cleartext during the establishment of HTTPS tunnels. This could expose sensitive cookie data to network attackers. Red Hat has issued a security advisory (RHSA-2026:14087) for Red Hat Enterprise Linux 8, providing updated libsoup packages that fix this issue. The vulnerability has a CVSS vector indicating network attack vector, high complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. The fix is included in libsoup version 2.62.3-14.el8_10 and later.

The vulnerability allows an attacker to gain unauthorized access to sensitive cookie information by intercepting cleartext transmissions during HTTPS tunnel establishment. This compromises confidentiality but has low impact on integrity and no impact on availability. The exposure of cookies could lead to session hijacking or other privacy breaches depending on the cookies' use.

Red Hat has released an official security update for libsoup in Red Hat Enterprise Linux 8 that addresses this vulnerability. Users should apply the update as described in Red Hat advisory RHSA-2026:14087. No additional mitigations are required beyond applying the official patch.