VulnerableCode Package Details - pkg:deb/debian/libsoup3@3.6.5-3

Search for packages

Vulnerability	Summary	Fixed by
VCID-1vz1-x5py-dkg5 Aliases: CVE-2026-1539	A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTTP redirects, libsoup removes the Authorization header but does not remove the Proxy-Authorization header if the request is redirected to a different host. As a result, sensitive proxy credentials may be leaked to third-party servers. Applications using libsoup for HTTP communication may unintentionally expose proxy authentication data.	3.6.6-1 Affected by 0 other vulnerabilities.
VCID-3zqd-pcvp-a7ed Aliases: CVE-2026-1760	libsoup: SoupServer: Denial of Service via HTTP request smuggling	3.6.6-1 Affected by 0 other vulnerabilities.
VCID-6sbg-fgfs-43b6 Aliases: CVE-2026-2443	libsoup: Out-of-Bounds Read in libsoup handle_partial_get() Leading to Heap Information Disclosure	3.6.6-1 Affected by 0 other vulnerabilities.
VCID-cjwc-3fs8-17ef Aliases: CVE-2026-1801	libsoup: libsoup: HTTP Request Smuggling via malformed chunk headers	3.6.6-1 Affected by 0 other vulnerabilities.
VCID-dnrq-3tff-nfc3 Aliases: CVE-2026-0716	libsoup: Out-of-Bounds Read in libsoup WebSocket Frame Processing	3.6.6-1 Affected by 0 other vulnerabilities.
VCID-ka6q-xta6-ukdp Aliases: CVE-2026-1761	libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response	3.6.6-1 Affected by 0 other vulnerabilities.
VCID-mxjn-d8v7-8ubc Aliases: CVE-2025-12105	libsoup: Heap Use-After-Free in libsoup message queue handling during HTTP/2 read completion	3.6.6-1 Affected by 0 other vulnerabilities.
VCID-nbx2-3qh6-tqa3 Aliases: CVE-2025-14523	libsoup: libsoup: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (First- vs Last-Value Wins)	3.6.6-1 Affected by 0 other vulnerabilities.
VCID-nu2x-tpra-4few Aliases: CVE-2026-1536	libsoup: libsoup: HTTP header injection or response splitting via CRLF injection in Content-Disposition header	3.6.6-1 Affected by 0 other vulnerabilities.
VCID-sccj-juvj-5ud5 Aliases: CVE-2026-1467	libsoup: libsoup: HTTP header injection via specially crafted URLs when an HTTP proxy is configured	3.6.6-1 Affected by 0 other vulnerabilities.
VCID-tpky-j79x-pqd4 Aliases: CVE-2025-11021	libsoup: Out-of-Bounds Read in Cookie Date Handling of libsoup HTTP Library	3.6.6-1 Affected by 0 other vulnerabilities.
VCID-vsry-jr8n-zba8 Aliases: CVE-2026-2369	libsoup: libsoup: Buffer overread due to integer underflow when handling zero-length resources	3.6.6-1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-1vz1-x5py-dkg5
Aliases:
CVE-2026-1539

A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTTP redirects, libsoup removes the Authorization header but does not remove the Proxy-Authorization header if the request is redirected to a different host. As a result, sensitive proxy credentials may be leaked to third-party servers. Applications using libsoup for HTTP communication may unintentionally expose proxy authentication data.