Libsoup: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in Red Hat Red Hat Enterprise Linux 10 (CVE-2025-14523)
A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the backend interprets it as destined for another host. This discrepancy enables request-smuggling style attacks, cache poisoning, or bypassing host-based access controls when an attacker supplies duplicate Host headers.
AI Analysis
Technical Summary
The libsoup library contained a vulnerability where duplicate Host headers were handled inconsistently, leading to a discrepancy in host parsing (first- versus last-value wins). This issue is tracked as CVE-2025-14523 and is classified under CWE-444. Red Hat released an update for Red Hat Enterprise Linux 8.2 AUS to address this vulnerability by updating libsoup to version 2.62.3-1.el8_2.7. The advisory rates the security impact as important, but no CVSS base score is provided. The vendor advisory confirms the availability of a patch and provides instructions for applying the update.
Potential Impact
The vulnerability causes inconsistent parsing of duplicate Host headers in HTTP requests, which may lead to unexpected behavior in applications relying on libsoup for HTTP communication. The exact impact details are not specified beyond the host-parsing discrepancy. Red Hat rates the security impact as important, indicating a significant but not critical risk.
Mitigation Recommendations
A security update for libsoup is available from Red Hat for Red Hat Enterprise Linux 8.2 AUS. Users should apply the update to libsoup version 2.62.3-1.el8_2.7 or later as provided in the Red Hat advisory RHSA-2026:0911. Refer to https://access.redhat.com/articles/11258 for detailed update instructions. No additional mitigation steps are indicated by the vendor.
Libsoup: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in Red Hat Red Hat Enterprise Linux 10 (CVE-2025-14523)
Description
A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the backend interprets it as destined for another host. This discrepancy enables request-smuggling style attacks, cache poisoning, or bypassing host-based access controls when an attacker supplies duplicate Host headers.
CVSS v3.1
Score 8.2high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The libsoup library contained a vulnerability where duplicate Host headers were handled inconsistently, leading to a discrepancy in host parsing (first- versus last-value wins). This issue is tracked as CVE-2025-14523 and is classified under CWE-444. Red Hat released an update for Red Hat Enterprise Linux 8.2 AUS to address this vulnerability by updating libsoup to version 2.62.3-1.el8_2.7. The advisory rates the security impact as important, but no CVSS base score is provided. The vendor advisory confirms the availability of a patch and provides instructions for applying the update.
Potential Impact
The vulnerability causes inconsistent parsing of duplicate Host headers in HTTP requests, which may lead to unexpected behavior in applications relying on libsoup for HTTP communication. The exact impact details are not specified beyond the host-parsing discrepancy. Red Hat rates the security impact as important, indicating a significant but not critical risk.
Mitigation Recommendations
A security update for libsoup is available from Red Hat for Red Hat Enterprise Linux 8.2 AUS. Users should apply the update to libsoup version 2.62.3-1.el8_2.7 or later as provided in the Red Hat advisory RHSA-2026:0911. Refer to https://access.redhat.com/articles/11258 for detailed update instructions. No additional mitigation steps are indicated by the vendor.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:0911
- Cve Count
- 1
Threat ID: 6a3da1ca4853345fc1821f7b
Added to database: 06/25/2026, 21:46:50 UTC
Last enriched: 06/25/2026, 22:02:00 UTC
Last updated: 09/10/2026, 19:36:49 UTC
Views: 68
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.