The vulnerability CVE-2025-14523 in libsoup involves improper handling of duplicate Host headers in HTTP requests. libsoup processes the last occurrence of the Host header, whereas front-end proxies typically use the first occurrence, causing a discrepancy in host interpretation. This inconsistency can be exploited to perform HTTP request smuggling attacks, cache poisoning, or to bypass host-based access controls by confusing the routing between proxy and backend servers. Red Hat has issued security advisories RHSA-2026:0421 and RHSA-2026:0422 providing updated libsoup packages that fix this issue for Red Hat Enterprise Linux 8 and 9 respectively.

The vulnerability allows attackers to exploit the mismatch in Host header processing between proxies and backend servers, potentially enabling HTTP request smuggling, cache poisoning, or bypassing host-based access controls. This can lead to unauthorized access or manipulation of web application behavior. The CVSS v3.1 base score is 8.2 (High), reflecting low attack complexity, no required privileges or user interaction, and high impact on integrity with limited impact on confidentiality and no impact on availability.

Red Hat has released official security updates that fix this vulnerability by correcting the Host header handling in libsoup. Users should apply the updated libsoup packages as detailed in Red Hat advisories RHSA-2026:0421 for Red Hat Enterprise Linux 8 and RHSA-2026:0422 for Red Hat Enterprise Linux 9. The advisories provide instructions and package details for remediation. Applying these updates is the recommended and effective mitigation.