In plain language
What this advisory means
The libsoup library used in Ubuntu had security issues where it failed to properly handle URLs when using an HTTP proxy, potentially letting attackers add harmful HTTP headers. It also did not remove proxy login information when following redirects, risking exposure of sensitive data. Additionally, it incorrectly processed some HTTP requests, which could leak sensitive information to attackers.
Technical explanation
How the issue affects the environment
Three vulnerabilities were identified in libsoup, an HTTP client/server library in GNOME. First, improper handling of certain URLs when an HTTP proxy is used allowed injection of arbitrary HTTP headers (CVE-2026-1467). Second, proxy authentication credentials were not removed when following HTTP redirects, leading to potential leakage of sensitive credentials (CVE-2026-1539). Third, incorrect parsing of specific HTTP requests allowed remote attackers to possibly obtain sensitive information (CVE-2026-1801). These flaws affect HTTP proxy handling and request parsing logic in libsoup, increasing the risk of unauthorized data exposure and malicious request manipulation.
Operational impact
Why teams should care
Applications relying on libsoup for HTTP communications may be vulnerable to attacks that inject malicious headers or leak sensitive proxy authentication credentials and HTTP request data. This undermines data confidentiality and integrity, potentially leading to unauthorized access and information disclosure, which could impact user privacy and organizational security compliance.
Immediate action
Users and administrators should update the libsoup packages on their systems to the fixed versions provided by Ubuntu, either through standard system updates or via Ubuntu Pro's Extended Security Maintenance as appropriate. Regularly applying security updates ensures the vulnerabilities are addressed.
Affected and fixed releases
Temporary risk reduction
The official source does not specify any workaround for these vulnerabilities beyond applying updates to the affected packages.
Evidence and validation checklist
- Official Ubuntu security notice USN-8780-1 details libsoup vulnerabilities and their fixes
- CVE entries CVE-2026-1467, CVE-2026-1539, CVE-2026-1801 summarized in the notice
- Update instructions and fixed package versions listed in USN-8780-1
- Disclosure by security researcher Ahmed Lekssays acknowledged in the notice
Authoritative reference
Ubuntu Security Notices
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.