The vulnerability CVE-2025-9901 affects the libsoup library's SoupCache component in Red Hat Enterprise Linux 10. The HTTP Vary header, which controls how cached responses vary based on request headers such as language or authentication, is ignored during cache evaluation. This can cause sensitive cached content to be served to unintended users, potentially leading to confidentiality breaches. The flaw is less likely to impact typical desktop users but poses a risk in proxy or multi-user scenarios. No known exploits are reported, and no patch or remediation details are provided in the vendor advisory content.

The vulnerability can lead to exposure of sensitive information by serving cached HTTP responses without properly considering the Vary header. This can result in confidentiality breaches, especially in environments where multiple users share the same proxy or caching infrastructure. Integrity and availability are not impacted. The CVSS score of 5.9 reflects a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2025-9901 for current remediation guidance. Until an official fix is available, consider limiting the use of affected caching mechanisms in multi-user or proxy environments to reduce risk. Monitor vendor communications for updates on patches or workarounds.