This vulnerability arises from libsoup's SoupCache ignoring the HTTP Vary header when determining cache validity. The HTTP Vary header is designed to ensure that cached responses vary appropriately based on request headers such as language or authentication. Ignoring this header can cause sensitive cached data to be served to unauthorized users, leading to confidentiality breaches. The vulnerability affects Red Hat Enterprise Linux 10 and has a CVSS 3.1 base score of 5.9, reflecting a network attack vector with high confidentiality impact but requiring high attack complexity and no privileges or user interaction. The flaw is primarily relevant in proxy or multi-user environments where caching is shared.

The impact is a potential confidentiality breach due to incorrect reuse of cached HTTP responses across different requests. This could expose sensitive user information to unauthorized parties in environments where multiple users share the same cache, such as proxy servers or multi-user systems. There is no impact on integrity or availability. The vulnerability is rated medium severity with a CVSS score of 5.9. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2025-9901 for current remediation guidance. Until a patch is applied, administrators should consider limiting the use of shared caching mechanisms involving libsoup in multi-user or proxy environments or implement additional controls to prevent unauthorized cache reuse. Monitor the vendor advisory for updates on official fixes or workarounds.