USN-8523-1: libsoup vulnerabilities

Q: Which deployments should be prioritized for the cookie exposure issue?

Prioritize applications that use libsoup to establish HTTPS tunnels through an HTTP proxy, especially where session cookies are used. The issue could allow an attacker to intercept those cookies and impersonate users or hijack sessions.

Q: What attacker condition is identified for the cookie issue?

The affected application must be establishing an HTTPS tunnel through an HTTP proxy. The provided information does not identify any other required attacker access or configuration conditions.

Q: How can I identify systems in scope for this update?

Check for the listed libsoup 2.4 packages on Ubuntu 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS, 25.10, or 26.04 LTS. The advisory specifically identifies those Ubuntu releases as affected by the zero-length resource handling issue.

Published Jul 9, 2026

Updated

Eric Su and Samuel Dainard discovered that libsoup incorrectly handled content with zero-length resources. An attacker could possibly use this issue to trigger a buffer over-read, resulting in information disclosure or a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-2369) Kona Arctic discovered that libsoup did not properly protect sensitive cookies when establishing HTTPS tunnels through an HTTP proxy. An attacker could possibly use this issue to intercept session cookies, resulting in session hijacking or user impersonation. (CVE-2026-5119)

Affected Software

60 affected componentsFixes available

All of the following

ubuntu/libsoup-2.4-1<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=26.04

All of the following

ubuntu/libsoup-gnome-2.4-1<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=26.04

All of the following

ubuntu/libsoup2.4-common<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=26.04

All of the following

ubuntu/libsoup2.4-dev<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=26.04

All of the following

ubuntu/libsoup2.4-tests<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=26.04

All of the following

ubuntu/libsoup-2.4-1<2.74.3-10.1ubuntu4.1

2.74.3-10.1ubuntu4.1

Ubuntu Ubuntu=25.10

All of the following

ubuntu/libsoup-gnome-2.4-1<2.74.3-10.1ubuntu4.1

2.74.3-10.1ubuntu4.1

Ubuntu Ubuntu=25.10

All of the following

ubuntu/libsoup2.4-common<2.74.3-10.1ubuntu4.1

2.74.3-10.1ubuntu4.1

Ubuntu Ubuntu=25.10

All of the following

ubuntu/libsoup2.4-dev<2.74.3-10.1ubuntu4.1

2.74.3-10.1ubuntu4.1

Ubuntu Ubuntu=25.10

All of the following

ubuntu/libsoup2.4-tests<2.74.3-10.1ubuntu4.1

2.74.3-10.1ubuntu4.1

Ubuntu Ubuntu=25.10

All of the following

ubuntu/libsoup-2.4-1<2.74.3-6ubuntu1.7

2.74.3-6ubuntu1.7

Ubuntu Ubuntu=24.04

All of the following

ubuntu/libsoup-gnome-2.4-1<2.74.3-6ubuntu1.7

2.74.3-6ubuntu1.7

Ubuntu Ubuntu=24.04

All of the following

ubuntu/libsoup2.4-common<2.74.3-6ubuntu1.7

2.74.3-6ubuntu1.7

Ubuntu Ubuntu=24.04

All of the following

ubuntu/libsoup2.4-dev<2.74.3-6ubuntu1.7

2.74.3-6ubuntu1.7

Ubuntu Ubuntu=24.04

All of the following

ubuntu/libsoup2.4-tests<2.74.3-6ubuntu1.7

2.74.3-6ubuntu1.7

Ubuntu Ubuntu=24.04

All of the following

ubuntu/libsoup-gnome2.4-1<2.74.2-3ubuntu0.7

2.74.2-3ubuntu0.7

Ubuntu Ubuntu=22.04

All of the following

ubuntu/libsoup2.4-1<2.74.2-3ubuntu0.7

2.74.2-3ubuntu0.7

Ubuntu Ubuntu=22.04

All of the following

ubuntu/libsoup2.4-common<2.74.2-3ubuntu0.7

2.74.2-3ubuntu0.7

Ubuntu Ubuntu=22.04

All of the following

ubuntu/libsoup2.4-dev<2.74.2-3ubuntu0.7

2.74.2-3ubuntu0.7

Ubuntu Ubuntu=22.04

All of the following

ubuntu/libsoup2.4-tests<2.74.2-3ubuntu0.7

2.74.2-3ubuntu0.7

Ubuntu Ubuntu=22.04

All of the following

ubuntu/libsoup-gnome2.4-1<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=20.04

All of the following

ubuntu/libsoup2.4-1<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=20.04

All of the following

ubuntu/libsoup2.4-dev<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=20.04

All of the following

ubuntu/libsoup2.4-tests<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=20.04

All of the following

ubuntu/libsoup-gnome2.4-1<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=18.04

All of the following

ubuntu/libsoup2.4-1<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=18.04

All of the following

ubuntu/libsoup2.4-dev<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=18.04

All of the following

ubuntu/libsoup-gnome2.4-1<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=16.04

All of the following

ubuntu/libsoup2.4-1<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=16.04

All of the following

ubuntu/libsoup2.4-dev<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=16.04

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/libsoup-2.4-1 to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/libsoup-gnome-2.4-1 to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/libsoup2.4-common to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/libsoup2.4-dev to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/libsoup2.4-tests to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/libsoup-2.4-1 to a version that resolves this vulnerability.
Fixed in 2.74.3-10.1ubuntu4.1
Upgrade
Upgrade ubuntu/libsoup-gnome-2.4-1 to a version that resolves this vulnerability.
Fixed in 2.74.3-10.1ubuntu4.1
Upgrade
Upgrade ubuntu/libsoup2.4-common to a version that resolves this vulnerability.
Fixed in 2.74.3-10.1ubuntu4.1
Upgrade
Upgrade ubuntu/libsoup2.4-dev to a version that resolves this vulnerability.
Fixed in 2.74.3-10.1ubuntu4.1
Upgrade
Upgrade ubuntu/libsoup2.4-tests to a version that resolves this vulnerability.
Fixed in 2.74.3-10.1ubuntu4.1
Upgrade
Upgrade ubuntu/libsoup-2.4-1 to a version that resolves this vulnerability.
Fixed in 2.74.3-6ubuntu1.7
Upgrade
Upgrade ubuntu/libsoup-gnome-2.4-1 to a version that resolves this vulnerability.
Fixed in 2.74.3-6ubuntu1.7
Upgrade
Upgrade ubuntu/libsoup2.4-common to a version that resolves this vulnerability.
Fixed in 2.74.3-6ubuntu1.7
Upgrade
Upgrade ubuntu/libsoup2.4-dev to a version that resolves this vulnerability.
Fixed in 2.74.3-6ubuntu1.7
Upgrade
Upgrade ubuntu/libsoup2.4-tests to a version that resolves this vulnerability.
Fixed in 2.74.3-6ubuntu1.7
Upgrade
Upgrade ubuntu/libsoup-gnome2.4-1 to a version that resolves this vulnerability.
Fixed in 2.74.2-3ubuntu0.7
Upgrade
Upgrade ubuntu/libsoup2.4-1 to a version that resolves this vulnerability.
Fixed in 2.74.2-3ubuntu0.7
Upgrade
Upgrade ubuntu/libsoup2.4-common to a version that resolves this vulnerability.
Fixed in 2.74.2-3ubuntu0.7
Upgrade
Upgrade ubuntu/libsoup2.4-dev to a version that resolves this vulnerability.
Fixed in 2.74.2-3ubuntu0.7
Upgrade
Upgrade ubuntu/libsoup2.4-tests to a version that resolves this vulnerability.
Fixed in 2.74.2-3ubuntu0.7
Upgrade
Upgrade ubuntu/libsoup-gnome2.4-1 to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/libsoup2.4-1 to a version that resolves this vulnerability.
Fixed in Ubuntu Pro

Event History

Jul 9, 2026

Advisory Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which deployments should be prioritized for the cookie exposure issue?

Prioritize applications that use libsoup to establish HTTPS tunnels through an HTTP proxy, especially where session cookies are used. The issue could allow an attacker to intercept those cookies and impersonate users or hijack sessions.

What attacker condition is identified for the cookie issue?

The affected application must be establishing an HTTPS tunnel through an HTTP proxy. The provided information does not identify any other required attacker access or configuration conditions.

How can I identify systems in scope for this update?

Check for the listed libsoup 2.4 packages on Ubuntu 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS, 25.10, or 26.04 LTS. The advisory specifically identifies those Ubuntu releases as affected by the zero-length resource handling issue.

USN-8523-1: libsoup vulnerabilities

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments should be prioritized for the cookie exposure issue?

What attacker condition is identified for the cookie issue?

How can I identify systems in scope for this update?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be prioritized for the cookie exposure issue?

What attacker condition is identified for the cookie issue?

How can I identify systems in scope for this update?