CVE-2026-66339

Katalog CVE

CVSS 6.5 · Medium EPSS 0,25%

Kerentanan Insertion of Sensitive Information Into Sent Data pada gnome libsoup, redhat enterprise linux. Skor CVSS 3.1 6.5 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.

Rincian

Terbit di NVD

24 Juli 2026

Terakhir diubah

24 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-201: Insertion of Sensitive Information Into Sent Data

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 14,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-66339 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2506951 issue tracking · advisory vendor · exploit · mitigasi