PT-2025-35713 · Libsoup+1 · Libsoup+1

Zkbytes · Publicado 2025-09-03 · Atualizado 2026-05-06 · CVE-2025-9901

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions libsoup (affected versions not specified)

Description A flaw exists in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. The HTTP Vary header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information. This issue could result in confidentiality breaches in proxy or multi-user environments.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-524

Identificadores relacionados

AZL-67058

AZL-67061

CVE-2025-9901

ECHO-0BD2-8B5E-2B5A

Produtos afetados

Debian

Libsoup

Referências · 15

• https://gitlab.gnome.org/GNOME/libsoup/-/issues/453 · Nota
• https://t.me/CVEtracker/31596 · Publicação no Telegram
• https://osv.dev/vulnerability/AZL-67061 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2025-9901 · Nota
• https://twitter.com/CVEnew/status/1963238380730523729 · Publicação no Twitter
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-9901 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=2392790 · Nota
• https://t.me/cveNotify/162385 · Publicação no Telegram
• https://osv.dev/vulnerability/AZL-67058 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2025-9901 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2025-9901 · Nota de Segurança
• https://ubuntu.com/security/CVE-2025-9901 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2025-9901 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-9901 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-9901 · Aviso do Fabricante