Hello Kyle, Thank you for opening the upstream issue and for confirming the leak on 3.4.4, 3.6.6 and 3.8.0.
The fix is already proposed upstream as a merge request: https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/577 It is the same patch as the one attached to this bug. allow_cookies_for_request() now looks up the connection only for CONNECT messages and drops the reference after use, as auth_msg_starting() already does. The /proxy/secure-cookies test now checks that the tunnel connection is finalized. The merge request’s CI pipeline passed on 18 October, so it can close issue #559 once a maintainer reviews it. When it is merged, we are happy to help test the backports for noble (3.4.4) and resolute (3.6.6). Best regards, Safeer -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2170998 Title: libsoup3 3.4.4-5ubuntu0.9: SoupConnection leak for every CONNECT through an HTTP proxy (regression from CVE-2026-5119 fix) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/libsoup3/+bug/2170998/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
