PT-2025-18149 · Libsoup+1 · Libsoup+1

Jan Różański · Published 2025-04-28 · Updated 2025-05-26 · CVE-2025-4035

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions libsoup (affected versions not specified)

Description A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-178

Related Identifiers

ALSA-2025:8128

AZL-61665

AZL-61670

BDU:2025-10922

CVE-2025-4035

ECHO-BB6E-A23A-D95A

RHSA-2025:8128

Affected Products

Debian

Libsoup

References · 29

• https://osv.dev/vulnerability/AZL-61665 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:8128 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-4035 · Vendor Advisory
• https://errata.almalinux.org/10/ALSA-2025-8128.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-4035 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-4035 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-61670 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2025:8128 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10922 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-4035 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4035 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-4035 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-4035 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2025-4948 · Note
• https://twitter.com/CVEnew/status/1917204814884229407 · Twitter Post