PT-2026-64428 · Red Hat · Red Hat Enterprise Linux 10+4

CVE-2026-66339 · Published 2026-07-24 · Updated 2026-07-24

Mitre

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.

Fix

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2026-66339

Affected Products

Red Hat Enterprise Linux 10

Red Hat Enterprise Linux 6

Red Hat Enterprise Linux 7

Red Hat Enterprise Linux 8

Red Hat Enterprise Linux 9

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-66339 · Security Note
• https://access.redhat.com/security/cve/CVE-2026-66339 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2506951 · Note