Libsoup Vulnerabilities Expose Web Apps to Header Injection and Credential Leaks
Multiple vulnerabilities in libsoup may allow attackers to inject HTTP headers and steal proxy credentials. These issues affect applications using the library for HTTP communication.
TL;DR
- libsoup mishandles URLs with HTTP proxies, enabling header injection (CVE-2026-1467).
- Proxy authentication credentials aren't stripped during redirects, risking exposure (CVE-2026-1539).
- Improper parsing of HTTP requests may leak sensitive data (CVE-2026-1801).
- Affects Ubuntu systems using libsoup; update recommended.
- Developers using libsoup should audit their HTTP handling logic.
Ubuntu has disclosed multiple critical vulnerabilities in the libsoup library, a core component used for HTTP communication in many applications. These flaws could allow remote attackers to manipulate HTTP traffic or access sensitive authentication data.
The vulnerabilities stem from improper handling of HTTP requests, proxy configurations, and URL parsing. Applications relying on libsoup—especially those processing untrusted input—should evaluate their exposure and apply updates immediately.
Organizations using Ubuntu-based systems or embedding libsoup in custom applications are advised to review their attack surface and patch promptly.
Header Injection via Proxy Misconfiguration
- CVE-2026-1467 allows attackers to inject arbitrary HTTP headers by exploiting how libsoup processes URLs through HTTP proxies.
- This can lead to request smuggling, session fixation, or bypassing security controls that rely on header integrity.
- Applications accepting user-controlled URLs or proxy settings are particularly at risk.
Credential Exposure Through Redirects
- CVE-2026-1539 causes libsoup to retain proxy authentication credentials when following HTTP redirects.
- An attacker who triggers a redirect to a malicious server could capture these credentials.
- This flaw impacts any client-side app using libsoup for authenticated proxy connections.
Sensitive Data Leak via Request Parsing
- Discovered by Ahmed Lekssays, CVE-2026-1801 involves incorrect parsing of HTTP requests which may expose internal data.
- Exploitation depends on specific request structures that trigger unexpected behavior in the parser.
- Applications parsing complex or untrusted HTTP inputs should be reviewed for potential leakage points.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.