A flaw in the libsoup library causes sensitive session cookies to be sent in cleartext when establishing HTTPS tunnels through a configured HTTP proxy. The cleartext cookie data is included in the initial HTTP CONNECT request. An attacker positioned on the network or operating a malicious proxy could intercept these cookies, enabling session hijacking or user impersonation. The weakness is categorized as CWE‑319, which highlights the exposure of cryptographic keys or secrets over an insecure channel.

The vulnerability affects Red Hat Enterprise Linux releases 6 through 10 that utilize libsoup. All packages derived from these RHEL distributions could inherit the flaw, as no specific libsoup version is cited. The issue is also known in the GNOME libsoup component, but the primary impact is on RHEL users.

The CVSS score of 5.9 indicates moderate severity. The EPSS score is below 1 %, suggesting a low likelihood of exploitation in the wild at this time, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector is a network-positioned attacker able to observe or control the HTTP proxy traffic. While exploitation requires the attacker to either compromise or proxy the HTTPS tunnel, it can be performed by a malicious or misconfigured proxy, which is inferred from the description.