The libsoup library in Red Hat Enterprise Linux 9 contains a vulnerability (CVE-2026-5119) that allows information disclosure through cleartext transmission of cookies during HTTPS tunnel establishment. This could potentially expose sensitive cookie data during the setup of HTTPS tunnels. Red Hat has released updated libsoup packages to fix this issue, as detailed in advisory RHSA-2026:19356. The vulnerability is rated as moderate severity and affects multiple architectures supported by Red Hat Enterprise Linux 9.

The vulnerability allows sensitive cookie information to be transmitted in cleartext during HTTPS tunnel establishment, which could lead to information disclosure. This may impact confidentiality of session or authentication cookies handled by libsoup. There are no reports of active exploitation in the wild at this time.

Red Hat has released updated libsoup packages that address this vulnerability. Users of affected Red Hat Enterprise Linux 9 versions should apply the security update as described in Red Hat advisory RHSA-2026:19356 and the referenced article https://access.redhat.com/articles/11258. Applying the official update fully mitigates the issue. No additional mitigations are specified or required by the vendor.