PT-2025-35713 · Libsoup+1 · Libsoup+1

Zkbytes · Published 2025-09-03 · Updated 2026-05-06 · CVE-2025-9901

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions libsoup (affected versions not specified)

Description A flaw exists in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. The HTTP Vary header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information. This issue could result in confidentiality breaches in proxy or multi-user environments.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-524

Related Identifiers

AZL-67058

AZL-67061

CVE-2025-9901

ECHO-0BD2-8B5E-2B5A

Affected Products

Debian

Libsoup

References · 15

• https://osv.dev/vulnerability/AZL-67061 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-9901 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-67058 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-9901 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-9901 · Security Note
• https://ubuntu.com/security/CVE-2025-9901 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-9901 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9901 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-9901 · Vendor Advisory
• https://gitlab.gnome.org/GNOME/libsoup/-/issues/453 · Note
• https://t.me/CVEtracker/31596 · Telegram Post
• https://access.redhat.com/security/cve/CVE-2025-9901 · Note
• https://twitter.com/CVEnew/status/1963238380730523729 · Twitter Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2392790 · Note
• https://t.me/cveNotify/162385 · Telegram Post