Critical Security Flaw in libsoup: Duplicate Host Header Handling Vulnerability
Summary
ALSA-2026:0421: Important: libsoup security update. Affects libsoup versions < 2.62.3-11.el8_10. Fixed in 2.62.3-11.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libsoup is an HTTP client and server library designed for the GNOME desktop environment. It provides essential functionalities for web communication, allowing applications to send and receive HTTP requests and responses. The library is widely used in various applications that require network communication, making its security paramount. The recent vulnerability identified in libsoup raises concerns about how it handles duplicate Host headers, which could lead to discrepancies in host parsing.
Vulnerability Detail
The vulnerability, identified as CVE-2025-14523, arises from the way libsoup processes duplicate Host headers in HTTP requests. Specifically, the library exhibits a 'first- vs last-value wins' behavior, leading to potential inconsistencies in how the Host header is interpreted. This flaw can be exploited by attackers to manipulate HTTP requests, potentially redirecting traffic or causing denial-of-service conditions. The ramifications of this vulnerability could affect the integrity and availability of applications relying on libsoup for HTTP communication.
How To Fix
Minimum fixed version
2.62.3-11.el8_10
This is the first release that contains the fix.
sudo dnf update libsoupTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement strict validation of HTTP headers in their applications to prevent the exploitation of this vulnerability until the update can be applied. However, this is not a substitute for updating the affected packages.
Conclusion
The libsoup security vulnerability CVE-2025-14523 poses significant risks due to its handling of duplicate Host headers. Users are strongly advised to update their packages to the latest version to mitigate these risks. Implementing workarounds can provide temporary relief, but updating is the most effective solution.
See every vulnerability recorded for libsoup →
FAQ
libsoup is an HTTP client and server library for the GNOME desktop environment, facilitating web communication for applications.
CVE-2025-14523 refers to a security vulnerability in libsoup related to the handling of duplicate Host headers, leading to potential security risks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability could allow attackers to manipulate HTTP requests, potentially leading to traffic redirection or denial-of-service conditions.
Regularly update your libsoup and libsoup-devel packages to the latest versions and monitor for any security advisories.
Related vulnerabilities
Recent vulnerabilities recorded for libsoup.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
