Critical Security Flaw in libsoup: Duplicate Host Header Handling Vulnerability
Summary
ALSA-2026:0422: Important: libsoup security update. Affects libsoup versions < 2.72.0-12.el9_7.3. Fixed in 2.72.0-12.el9_7.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libsoup is an HTTP client and server library designed for GNOME, facilitating the development of applications that require web communication. It provides essential functionalities for handling HTTP requests and responses, making it a vital component for many applications within the GNOME ecosystem. However, a recent vulnerability has been identified that affects how the library processes duplicate Host headers, potentially leading to security issues.
Vulnerability Detail
The vulnerability arises from the handling of duplicate Host headers in HTTP requests, where the library may not correctly parse the intended host value. This discrepancy, known as the 'First- vs Last-Value Wins' issue, can lead to unintended behavior, allowing attackers to manipulate requests and potentially redirect traffic or exploit other vulnerabilities in the application. The identified CVE-2025-14523 highlights the severity of this issue, emphasizing the need for immediate attention.
How To Fix
Minimum fixed version
2.72.0-12.el9_7.3
This is the first release that contains the fix.
sudo dnf update libsoupTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing input validation to ensure that only valid Host headers are processed. This can help mitigate the risk until the package is updated. However, updating to the patched version is strongly recommended for a permanent solution.
Conclusion
The libsoup library has a critical vulnerability related to duplicate Host header handling, which can lead to significant security risks. Updating to the patched version is crucial to ensure the security of applications utilizing this library. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for libsoup →
FAQ
The vulnerability can lead to incorrect parsing of Host headers, potentially allowing attackers to manipulate HTTP requests and exploit other vulnerabilities.
You can check if your application is affected by using the Vulert playground, which analyzes your manifest file for known vulnerabilities.
Implement input validation as a temporary workaround to mitigate risks until you can update to the patched version.
Detailed information about the CVE-2025-14523 can be found on the official CVE page, which includes the impact, CVSS score, and acknowledgments.
Yes, you can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software without requiring access to the code.
Related vulnerabilities
Recent vulnerabilities recorded for libsoup.
