CVE-2026-66339: A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests s
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-66339
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-663390.23% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 14% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-66339 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for libsoup. After a
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- high[UPDATE] [hoch] Red Hat Enterprise Linux (SSSD, libsoup): Mehrere Schwachstellencert-bund · 2026-07-31
- mediumCVE-2026-66338: A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing fu…nvd · 2026-07-24
- mediumCVE-2026-66337: A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_rea…nvd · 2026-07-24
- mediumCVE-2026-12548: A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an …nvd · 2026-07-21
- high[UPDATE] [high] Red Hat Enterprise Linux (libsoup): Vulnerability allows information disclosurecert-bund · 2026-07-17
- high[UPDATE] [high] Red Hat Enterprise Linux (libsoup): Multiple vulnerabilitiescert-bund · 2026-07-17
More from NVD Recent CVEs
- highCVE-2026-10848: The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (…2026-08-02
- highCVE-2026-9856: A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform…2026-08-02
- criticalCVE-2026-65321: PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated at…2026-08-02
- lowCVE-2026-10774: Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-ke…2026-08-02
- mediumCVE-2026-68583: luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in t…2026-08-02