Thanks! Note that there is no upstream report yet - the leak is not tracked at gitlab.gnome.org/GNOME/libsoup. The attached patch applies to both 3.4.4-5ubuntu0.9 and upstream master. Could Ubuntu ship it as a distro patch in the next SRU (like the CVE-2026-5119 patch itself), or forward it upstream?
** CVE added: https://cve.org/CVERecord?id=CVE-2026-5119 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2170998 Title: libsoup3 3.4.4-5ubuntu0.9: SoupConnection leak for every CONNECT through an HTTP proxy (regression from CVE-2026-5119 fix) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/libsoup3/+bug/2170998/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
