Critical Security Flaw in libsoup3: Duplicate Host Header Handling Vulnerability
Summary
RLSA-2026:0423: Important: libsoup3 security update. Affects libsoup3 versions < 0:3.6.5-3.el10_1.8. Fixed in 0:3.6.5-3.el10_1.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libsoup is an HTTP library implementation in C, designed to facilitate asynchronous HTTP requests in GNOME applications. Originally part of a SOAP implementation, it has since been separated into distinct packages. Libsoup leverages the Glib main loop, making it compatible with GTK applications, and supports both synchronous and asynchronous operation modes. The library's functionality is crucial for applications that require network communication, but it has recently been found to have a significant security vulnerability.
Vulnerability Detail
The vulnerability in libsoup3 arises from improper handling of duplicate Host headers, leading to a host-parsing discrepancy where the first or last value wins. This flaw, identified as CVE-2025-14523, can potentially allow an attacker to manipulate HTTP requests, leading to unauthorized access or data exposure. The CVSS score for this vulnerability is 8.2, indicating a high severity level that necessitates immediate attention.
How To Fix
Minimum fixed version
0:3.6.5-3.el10_1.8
This is the first release that contains the fix.
sudo dnf update libsoup3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using HTTP requests that include duplicate Host headers until the package is updated. This may involve reviewing application code to ensure that Host headers are unique and properly formatted.
Conclusion
The libsoup3 vulnerability, identified as CVE-2025-14523, poses a significant risk due to improper handling of duplicate Host headers. Users are strongly advised to update to the latest version to mitigate potential security threats. Utilizing tools like Vulert can further enhance security monitoring and vulnerability management.
See every vulnerability recorded for libsoup3 →
FAQ
Libsoup3 is an HTTP library in C that allows GNOME applications to communicate with HTTP servers asynchronously.
The CVE-2025-14523 vulnerability involves improper handling of duplicate Host headers, which can lead to security issues such as unauthorized access.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check for vulnerabilities in real-time.
It is recommended to update libsoup3 to the latest patched version to mitigate the vulnerability.
Yes, Vulert allows you to monitor vulnerabilities using just a manifest file, making it easy to stay informed without needing to install additional software.
Related vulnerabilities
Recent vulnerabilities recorded for libsoup3.
