CVE-2026-66339 — Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS request…
Published: 2026-07-24 · CVSS: 6.5 · CVSS 3.1
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7