REDHAT-BUG-2506951: Medium severity Gnome libsoup vulnerability
After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This means the destination server receives proxy credentials in cleartext (within the TLS session). Per HTTP standards, Proxy-Authorization should only appear on the CONNECT request itself, never on requests forwarded through the established tunnel. The proxy authentication logic in authmsgstarting() in libsoup/auth/soup-auth-manager.c runs unconditionally for all messages without checking whether the current request is being sent through an already-established CONNECT tunnel. This is distinct from CVE-2026-12547 which covers credential leak on proxy switch.
Upstream report: https://gitlab.gnome.org/GNOME/libsoup/-/workitems/534 PSIRTSUPT: https://redhat.atlassian.net/browse/PSIRTSUPT-17666
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2506951?
The severity of REDHAT-BUG-2506951 is medium with a score of 4.
How do I fix REDHAT-BUG-2506951?
To address REDHAT-BUG-2506951, update the Gnome libsoup software to the latest patched version.
What are the risks associated with REDHAT-BUG-2506951?
The risk associated with REDHAT-BUG-2506951 involves the exposure of proxy credentials in cleartext during HTTPS requests.
Which software is impacted by REDHAT-BUG-2506951?
The software impacted by REDHAT-BUG-2506951 is Gnome libsoup.
When was REDHAT-BUG-2506951 published?
REDHAT-BUG-2506951 was published on July 24, 2026.