Skip to main content

libsoup CVE-2025-14523

HIGH
HTTP Request/Response Smuggling (CWE-444)
2025-12-11 secalert@redhat.com
Authentication Bypass Request Smuggling
8.2
CVSS 3.1 · Vendor: redhat
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft request with duplicate Host headers
  2. Delivery
    Send to proxy fronting libsoup
  3. Exploit
    Proxy routes using first Host
  4. Execution
    libsoup processes last Host
  5. Persist
    Vhost confusion / request desync
  6. Impact
    Bypass host-based access controls or poison cache

Vulnerability Assessment

Weakness
CWE
CWE-444
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service HTTP request consistency
Exploitation Conditions

Exploitation requires libsoup performing server-side HTTP request processing, deployment behind a front/reverse proxy whose Host-header selection differs from libsoup's (specifically a proxy that honors the FIRST Host header while libsoup uses the LAST), and the attacker's ability to send a crafted request carrying duplicate Host: headers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction is needed once those architectural conditions are met. The key limiting factor is the proxy/backend topology: a libsoup instance not fronted by a divergent proxy, or one where the proxy already rejects multiple Host headers, is not exploitable, and purely client-side libsoup usage is largely out of scope.
Impact

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N, base 8.2) indicates a network-reachable, low-complexity, unauthenticated attack with high integrity impact and low confidentiality impact - consistent with smuggling and access-control bypass rather than data theft or denial of service. Real-world risk is conditional: exploitation requires libsoup to sit behind a front proxy whose Host-header handling differs from libsoup's, so this is an architecture-dependent rather than universally exploitable flaw. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active exploitation or published exploit code; treat this as a credible-but-not-urgent priority where libsoup processes externally routed HTTP behind a proxy, and lower priority for pure client-side libsoup usage. Note the 'Authentication Bypass' tag refers to host-based access-control bypass via vhost confusion, not credential bypass - verify against your own proxy topology before assuming exposure.
Exploit ScenarioDerived

An attacker sends a single HTTP request containing two Host: headers - the first naming a permitted/public vhost and the second naming an internal or restricted host - to a libsoup-backed service deployed behind a reverse proxy. The proxy authorizes and routes the request based on the first Host header, but libsoup processes the second, causing the request to be served as the restricted host and bypassing host-based access controls or poisoning a shared cache. No public exploit is identified at time of analysis, but the technique follows well-known HTTP desync patterns and the low attack complexity makes weaponization straightforward against vulnerable proxy/libsoup pairings.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 25, 2026

HTTP request smuggling in libsoup, GNOME's HTTP client/server library, lets remote unauthenticated attackers exploit inconsistent Host header parsing: libsoup accepts multiple Host: headers and processes the last occurrence, while common front-end proxies honor the first. Supplying duplicate Host headers creates a proxy/backend mismatch enabling vhost confusion, request smuggling, cache poisoning, and bypass of host-based access controls. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but Red Hat has shipped fixes across numerous products (15 RHSA errata).

RemediationAI

Patch available per vendor advisory: apply the libsoup updates from the relevant Red Hat erratum for your platform (for example https://access.redhat.com/errata/RHSA-2026:0421 and the related RHSA-2026:0422/0423/0836/0867/0868/0905-0911/0925/1509/1569), then restart or rebuild applications that link libsoup so the patched library is loaded. No exact upstream fixed version number was included in the input, so confirm the precise fixed package version from the RHSA that matches your release rather than assuming one. As a compensating control where immediate patching is not possible, harden the front-end proxy to reject any request containing more than one Host header and to normalize/canonicalize Host before forwarding, which closes the parser-disagreement gap; the trade-off is that strict rejection may break non-compliant clients. Also ensure the proxy and libsoup agree on Host handling and avoid relying solely on host-based access controls at the backend, since those are the specific controls this flaw can bypass.

Affected ProductsAI

The affected product is libsoup, GNOME's HTTP library, as shipped in Red Hat Enterprise Linux and related products. No exact upstream fixed version or CPE range was provided in the input, but Red Hat has published an extensive set of advisories covering the affected packages: RHSA-2026:0421, RHSA-2026:0422, RHSA-2026:0423, RHSA-2026:0836, RHSA-2026:0867, RHSA-2026:0868, RHSA-2026:0905, RHSA-2026:0906, RHSA-2026:0907, RHSA-2026:0908, RHSA-2026:0909, RHSA-2026:0911, RHSA-2026:0925, RHSA-2026:1509, and RHSA-2026:1569 (all under https://access.redhat.com/errata/). The breadth of these errata indicates multiple libsoup-consuming product streams are impacted; consult the specific RHSA matching your platform for the exact fixed package version.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libsoup is the GTK/GNOME HTTP library used by GNOME desktop applications and services on Linux, and it can act as an HTTP server. The root cause maps to CWE-444 (Inconsistent Interpretation of HTTP Requests / request smuggling): when a request contains more than one Host: header, libsoup forwards the last occurrence to server-side processing instead of rejecting the malformed message. Per RFC 7230 a request with multiple Host headers should be rejected; because intermediary proxies frequently honor the first Host header, the two ends of the connection disagree on the intended virtual host. That parsing discrepancy is the classic precondition for HTTP desync attacks, allowing a request the proxy routes to one backend/vhost to be interpreted by libsoup as belonging to another.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
vuln.today AI 8.2 HIGH

Remote, unauthenticated, low-complexity Host-header smuggling with high integrity impact (access-control bypass) and limited confidentiality exposure; no availability impact and scope unchanged within the parsing component.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 8.2 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
High
Availability
None

DescriptionCVE.org

A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the backend interprets it as destined for another host. This discrepancy enables request-smuggling style attacks, cache poisoning, or bypassing host-based access controls when an attacker supplies duplicate Host headers.

Executive ViewAI

Why It Matters

libsoup, a core library in GNOME services, contains an HTTP request smuggling flaw (CVSS 8.2) that allows unauthenticated remote attackers to bypass authentication controls and manipulate cached web content. Although no public exploit identified at time of analysis, immediate patching is critical as Red Hat has released security patches that must be deployed across affected systems.

Business Impact: High
Compensating Controls

Apply Red Hat RHSA patches. Interim mitigations if deployment is delayed: configure proxies to reject requests with duplicate Host headers; implement WAF rules for Host header normalization and consistency validation.

Threat Intelligence Overview

EPSS Score
0.5%
Top 61% exploitable
Prevalence
High
core HTTP library in the GNOME stack, shipped across Linux distros
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.5%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

41
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +41
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

HTTP Request Smuggling HIGH

HTTP request smuggling exploits inconsistencies in how front-end and back-end servers parse HTTP message boundaries.

Same weakness CWE-444 – HTTP Request/Response Smuggling

View all
CVE-2023-41265 CRITICAL POC
9.9
CVE-2026-88773 CRITICAL POC
9.3
CVE-2026-48710 MEDIUM POC
6.5
CVE-2021-33037 MEDIUM
5.3
CVE-2021-23336 MEDIUM POC
5.9
CVE-2025-55315 CRITICAL POC
9.9
CVE-2018-3907 CRITICAL POC
10.0
CVE-2024-10264 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/toolbox:latest Affected
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production Affected
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed

References

Advisories & patches
ADVISORY https://vuldb.com/vuln/335888 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0123/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0151/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0211/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0253/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0257/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0258/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20053/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20360/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20752/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20902/ REF https://access.redhat.com/errata/RHSA-2026:0421 REF https://access.redhat.com/errata/RHSA-2026:0422 REF https://access.redhat.com/errata/RHSA-2026:0423 REF https://access.redhat.com/errata/RHSA-2026:0836 REF https://access.redhat.com/errata/RHSA-2026:0867 REF https://access.redhat.com/errata/RHSA-2026:0868 REF https://access.redhat.com/errata/RHSA-2026:0905 REF https://access.redhat.com/errata/RHSA-2026:0906 REF https://access.redhat.com/errata/RHSA-2026:0907 REF https://access.redhat.com/errata/RHSA-2026:0908 REF https://access.redhat.com/errata/RHSA-2026:0909 REF https://access.redhat.com/errata/RHSA-2026:0911 REF https://access.redhat.com/errata/RHSA-2026:0925 REF https://access.redhat.com/errata/RHSA-2026:1509 REF https://access.redhat.com/errata/RHSA-2026:1569 REF https://access.redhat.com/errata/RHSA-2026:1570 REF https://access.redhat.com/errata/RHSA-2026:1571 REF https://access.redhat.com/errata/RHSA-2026:1572 REF https://access.redhat.com/security/cve/CVE-2025-14523 REF https://bugzilla.redhat.com/show_bug.cgi?id=2421349 REF https://gitlab.gnome.org/GNOME/libsoup/-/issues/472

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy