Libsoup3, a C-based HTTP library used in GNOME applications and Red Hat Enterprise Linux 10, contains two vulnerabilities. CVE-2026-4271 is a use-after-free vulnerability in the HTTP/2 server component that can lead to denial of service. CVE-2026-5119 involves the cleartext transmission of cookies during HTTPS tunnel establishment, resulting in potential information disclosure. Red Hat has released security updates for libsoup3 in Red Hat Enterprise Linux 10 and related products to fix these issues. The advisory references updated packages version 3.6.5-3.el10_2.11 and provides instructions for applying the update. No CVSS scores are provided in the advisory, but the severity is rated as moderate.

Successful exploitation of CVE-2026-4271 can cause denial of service by triggering a use-after-free condition in the HTTP/2 server implementation of libsoup3. CVE-2026-5119 can lead to information disclosure by transmitting cookies in cleartext during HTTPS tunnel establishment, potentially exposing sensitive session data. These vulnerabilities affect network-facing components and could impact applications relying on libsoup3 for HTTP communications.

Red Hat has released updated libsoup3 packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 10 and related products should apply the security update as described in the Red Hat advisory RHSA-2026:19143 and the referenced article https://access.redhat.com/articles/11258. Applying the official update is the recommended mitigation. No additional vendor-recommended mitigations or workarounds are indicated in the advisory.