Back Linuxsecurity Ubuntu 26.04 LTS libsoup Faces Critical Session Hijacking and DoS Issues
Several security issues were fixed in libsoup. Software Description: - libsoup2.4: HTTP client/server library for GNOME Details: Eric Su and Samuel Dainard discovered that libsoup incorrectly handled content with zero-length resources. An attacker could possibly use this issue to trigger a buffer over-read, resulting in information disclosure or a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-2369) Kona Arctic discovered that libsoup did not properly protect sensitive cookies when establishing HTTPS tunnels through an HTTP proxy. An attacker could possibly use this issue to intercept session cookies, resulting in session hijacking or user impersonation. (CVE-2026-5119)
Several security issues were fixed in libsoup.
Software Description:
- libsoup2.4: HTTP client/server library for GNOME
Eric Su and Samuel Dainard discovered that libsoup incorrectly handled
content with zero-length resources. An attacker could possibly use this
issue to trigger a buffer over-read, resulting in information disclosure
or a denial of service. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and
Ubuntu 26.04 LTS. (CVE-2026-2369)
Kona Arctic discovered that libsoup did not properly protect sensitive
cookies when establishing HTTPS tunnels through an HTTP proxy. An
attacker could possibly use this issue to intercept session cookies,
resulting in session hijacking or user impersonation. (CVE-2026-5119)
The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS libsoup-2.4-1 2.74.3-10.1ubuntu5+esm1 Available with Ubuntu Pro libsoup-gnome-2.4-1 2.74.3-10.1ubuntu5+esm1 Available with Ubuntu Pro libsoup2.4-common 2.74.3-10.1ubuntu5+esm1 Available with Ubuntu Pro libsoup2.4-dev 2.74.3-10.1ubuntu5+esm1 Available with Ubuntu Pro libsoup2.4-tests 2.74.3-10.1ubuntu5+esm1 Available with Ubuntu Pro Ubuntu 25.10 libsoup-2.4-1 2.74.3-10.1ubuntu4.1 libsoup-gnome-2.4-1 2.74.3-10.1ubuntu4.1 libsoup2.4-common 2.74.3-10.1ubuntu4.1 libsoup2.4-dev 2.74.3-10.1ubuntu4.1 libsoup2.4-tests 2.74.3-10.1ubuntu4.1 Ubuntu 24.04 LTS libsoup-2.4-1 2.74.3-6ubuntu1.7 libsoup-gnome-2.4-1 2.74.3-6ubuntu1.7 libsoup2.4-common 2.74.3-6ubuntu1.7 libsoup2.4-dev 2.74.3-6ubuntu1.7 libsoup2.4-tests 2.74.3-6ubuntu1.7 Ubuntu 22.04 LTS libsoup-gnome2.4-1 2.74.2-3ubuntu0.7 libsoup2.4-1 2.74.2-3ubuntu0.7 libsoup2.4-common 2.74.2-3ubuntu0.7 libsoup2.4-dev 2.74.2-3ubuntu0.7 libsoup2.4-tests 2.74.2-3ubuntu0.7 Ubuntu 20.04 LTS libsoup-gnome2.4-1 2.70.0-1ubuntu0.5+esm2 Available with Ubuntu Pro libsoup2.4-1 2.70.0-1ubuntu0.5+esm2 Available with Ubuntu Pro libsoup2.4-dev 2.70.0-1ubuntu0.5+esm2 Available with Ubuntu Pro libsoup2.4-tests 2.70.0-1ubuntu0.5+esm2 Available with Ubuntu Pro Ubuntu 18.04 LTS libsoup-gnome2.4-1 2.62.1-1ubuntu0.4+esm7 Available with Ubuntu Pro libsoup2.4-1 2.62.1-1ubuntu0.4+esm7 Available with Ubuntu Pro libsoup2.4-dev 2.62.1-1ubuntu0.4+esm7 Available with Ubuntu Pro Ubuntu 16.04 LTS libsoup-gnome2.4-1 2.52.2-1ubuntu0.3+esm6 Available with Ubuntu Pro libsoup2.4-1 2.52.2-1ubuntu0.3+esm6 Available with Ubuntu Pro libsoup2.4-dev 2.52.2-1ubuntu0.3+esm6 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.
Ubuntu Security Notice USN-8523-1
Get the latest Linux and open source security news straight to your inbox.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
