The libsoup library used in GNOME for HTTP client and server functionality contains two security vulnerabilities: an integer overflow in cookie expiration date handling (CVE-2025-4945) and an out-of-bounds read in cookie date handling (CVE-2025-11021). These vulnerabilities could lead to memory corruption or crashes due to improper validation of cookie date fields. Red Hat has released updated libsoup packages for Red Hat Enterprise Linux 8.6 variants that address these issues. The advisory classifies the impact as important but does not provide CVSS scores. The fixes are included in libsoup version 2.62.3-2.el8_6.6 and related packages.

The vulnerabilities in libsoup could cause memory safety issues such as integer overflow and out-of-bounds reads when processing cookie expiration dates. This may lead to application crashes or potentially other unintended behavior in applications using libsoup for HTTP communications. Red Hat rates the security impact as important, indicating a significant but not critical risk. There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated libsoup packages for Red Hat Enterprise Linux 8.6 variants that fix these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2025:21664 and the referenced article https://access.redhat.com/articles/11258. Applying the official update will remediate the integer overflow and out-of-bounds read issues in cookie date handling. No additional mitigation steps are indicated by the vendor.