CVE-2025-11021 is an out-of-bounds read vulnerability in the cookie date handling logic of the libsoup HTTP library. When processing cookies with specially crafted expiration dates, libsoup may read memory beyond intended bounds, which can result in disclosure of sensitive memory contents from the affected process. This vulnerability affects libsoup versions included in Red Hat Enterprise Linux 9 and 10 distributions. Red Hat has issued security advisories RHSA-2025:18183 and RHSA-2025:19713 providing updated packages that fix this flaw. The CVSS v3.1 base score is 7.5 (high severity), with network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality only.

Successful exploitation of this vulnerability could allow an attacker to read out-of-bounds memory from the process using libsoup, potentially exposing sensitive information contained in memory. There is no impact on integrity or availability. The vulnerability is remotely exploitable without authentication or user interaction.

Red Hat has released official security updates that fix this vulnerability in affected versions of libsoup and libsoup3 packages for Red Hat Enterprise Linux 9 and 10. Users should apply these updates promptly. Refer to Red Hat advisories RHSA-2025:18183 and RHSA-2025:19713 and the update instructions at https://access.redhat.com/articles/11258 for detailed remediation steps. No additional mitigations are indicated by the vendor advisory.