Public bug reported:
The CVE-2026-5119 fix in 3.4.4-5ubuntu0.9 (debian/patches/CVE-2026-5119.patch) adds allow_cookies_for_request() in libsoup/cookies/soup-cookie-jar.c, which calls soup_connection_is_tunnelled (soup_message_get_connection (msg)). soup_message_get_connection() returns a new reference (g_weak_ref_get) that is never released, so every CONNECT message through a session with a SoupCookieJar leaks one SoupConnection together with its socket/TLS stream and buffers. Any application with a cookie jar and an HTTP proxy is affected. With WebKitGTK 2.52.6 on Ubuntu 24.04 browsing through a local HTTP proxy, the WebKitNetworkProcess grows continuously: setup (same profile, same pages, 9 minutes) network process PSS libsoup3 3.4.4-5ubuntu0.8, proxy 25 -> 25 MiB libsoup3 3.4.4-5ubuntu0.9, proxy 25 -> 57 MiB libsoup3 3.4.4-5ubuntu0.9, no proxy 21 -> 23 MiB 3.4.4-5ubuntu0.9 rebuilt with the attached patch 27 -> 31 MiB (flat for the last 4 minutes) On a real desktop the process reached 312 MiB after 40 minutes of browsing. The same code is in upstream master; the attached patch is the one prepared for upstream (GNOME/libsoup) and applies on top of the 0.9 package. [Test Plan] 1. On noble with libsoup-3.0-0 3.4.4-5ubuntu0.9, start any HTTP proxy on localhost (e.g. tinyproxy) and a WebKitGTK browser (or any libsoup client with a cookie jar) configured to use it. 2. Load a few HTTPS pages repeatedly for 10 minutes and record the PSS of WebKitNetworkProcess (grep Pss /proc/<pid>/smaps_rollup) every minute: it grows by several MiB per minute. 3. Install the fixed package and repeat: PSS stays flat. 4. Run the libsoup test suite: the patch extends /proxy/secure-cookies to assert that the tunnel SoupConnection is finalized (fails before, passes after). [Where problems could occur] The change only affects CONNECT messages checked by the cookie jar: it takes the connection, reads whether it is tunnelled, and drops the reference – the same pattern auth_msg_starting() already uses. If the connection is NULL the function now returns TRUE instead of passing NULL to soup_connection_is_tunnelled(). A mistake here could make cookies be sent (or not sent) on CONNECT to a proxy, which the extended test covers. [Other Info] Found and measured by the Safeer project (https://safeer.si), which uses WebKitGTK with a local DNS-over-HTTPS proxy. Upstream issue/patch: being filed at gitlab.gnome.org/GNOME/libsoup. ** Affects: libsoup3 (Ubuntu) Importance: Undecided Status: New ** Tags: noble regression-update -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2170998 Title: libsoup3 3.4.4-5ubuntu0.9: SoupConnection leak for every CONNECT through an HTTP proxy (regression from CVE-2026-5119 fix) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/libsoup3/+bug/2170998/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
