The libsoup library, which provides HTTP client and server functionality for GNOME, contains two security flaws: an integer overflow in cookie expiration date handling (CVE-2025-4945) and an out-of-bounds read in cookie date handling (CVE-2025-11021). These vulnerabilities could cause memory safety issues when processing cookie dates. Red Hat Product Security has released an advisory (RHSA-2025:22013) and updated libsoup packages for Red Hat Enterprise Linux 8.2 to fix these issues. The advisory rates the security impact as Important and directs users to apply the update to remediate the vulnerabilities. No CVSS scores are provided in the advisory, and no known exploits in the wild have been reported.

The vulnerabilities involve integer overflow and out-of-bounds read errors in libsoup's cookie date handling, which may lead to memory corruption or application crashes when processing HTTP cookies. This could potentially be exploited to cause denial of service or other unintended behavior in applications using libsoup. The advisory does not specify confirmed exploitation or broader impacts beyond these technical issues.

Red Hat has released updated libsoup packages for Red Hat Enterprise Linux 8.2 that address these vulnerabilities. Users should apply the official security update as described in Red Hat advisory RHSA-2025:22013 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the provided patches.