USN-8780-1: libsoup vulnerabilities
Ubuntu fixed three libsoup flaws enabling HTTP header injection via proxies and leakage of proxy credentials or request data.
USN-8780-1 patches three libsoup vulnerabilities: CVE-2026-1467, arbitrary HTTP header injection when handling certain URLs through an HTTP proxy; CVE-2026-1539, proxy authentication credentials not stripped when following redirects, exposing sensitive information; and CVE-2026-1801, disclosed by Ahmed Lekssays, sensitive information disclosure via incorrect parsing of certain HTTP requests. Remote attackers could potentially exploit all three issues.
- Header injection via mishandled proxy URLs (CVE-2026-1467).
- Proxy auth credentials retained across redirects (CVE-2026-1539).
- Malformed HTTP request parsing could leak sensitive data (CVE-2026-1801).
Vulnerabilities mentionedAll →
- CVE-2026-14675.3<1%libsoup: This vulnerability, known as CRLF (Carriage Return Line Feed) Injection, occurs when an HTTP proxy is configured and the library…published · gnome libsoup PoC
It was discovered that libsoup incorrectly handled certain URLs when using an HTTP proxy. A remote attacker could possibly use this issue to inject arbitrary HTTP headers. (CVE-2026-1467) It was discovered that libsoup did not remove proxy authentication credentials when following HTTP redirects. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-1539) Ahmed Lekssays discovered that libsoup incorrectly parsed certain HTTP requests. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-1801)
This source does not provide full text. Read it at ubuntu.com.