The libsoup library, used for HTTP client and server functionality in GNOME, contains two vulnerabilities: CVE-2025-4945, an integer overflow in cookie expiration date handling, and CVE-2025-11021, an out-of-bounds read in cookie date handling. Both vulnerabilities could lead to memory corruption or other unintended behavior when processing cookie expiration dates. Red Hat has issued security updates for libsoup in Red Hat Enterprise Linux 8.8 variants to fix these issues.

The integer overflow and out-of-bounds read vulnerabilities in libsoup may cause memory corruption or crashes when handling cookie expiration dates, potentially leading to denial of service or other security impacts depending on usage context. The advisory rates the security impact as Important (high severity). There are no known exploits in the wild at this time.

Red Hat has released updated libsoup packages (version 2.62.3-3.el8_8.6) for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Extended Update Support Extension 8.8. Users should apply these official updates to remediate the vulnerabilities. For detailed update instructions, refer to Red Hat's article at https://access.redhat.com/articles/11258. No additional mitigation is indicated by the vendor.