CVE-2026-1539: Libsoup: libsoup: credential leakage via http redirects
A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTTP redirects, libsoup removes the Authorization header but does not remove the Proxy-Authorization header if the request is redirected to a different host. As a result, sensitive proxy credentials may be leaked to third-party servers. Applications using libsoup for HTTP communication may unintentionally expose proxy authentication data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1539?
CVE-2026-1539 is classified as a medium severity vulnerability.
How do I fix CVE-2026-1539?
To fix CVE-2026-1539, update to the latest version of the libsoup library that contains the patch for this vulnerability.
What is the impact of CVE-2026-1539?
The impact of CVE-2026-1539 is that it can lead to the leakage of proxy authentication credentials to unintended remote destinations.
Who is affected by CVE-2026-1539?
CVE-2026-1539 affects applications that utilize the libsoup HTTP library for handling HTTP requests.
Is CVE-2026-1539 exploitable?
Yes, CVE-2026-1539 is exploitable if an application using libsoup processes HTTP redirects and does not handle the removal of proxy credentials correctly.