The vulnerability CVE-2025-11021 in libsoup3 is an out-of-bounds read in the cookie date handling code of the libsoup HTTP library, which is implemented in C and used in GNOME applications for asynchronous HTTP access. This flaw could lead to reading memory outside the intended buffer boundaries. Red Hat has released security updates for Red Hat Enterprise Linux 10 and its extended update support versions across multiple architectures (x86_64, s390x, ppc64le, aarch64) to remediate this issue. The advisory classifies the impact as important and provides updated packages to fix the vulnerability.

The out-of-bounds read vulnerability in libsoup3 could allow an attacker to cause improper memory access when handling cookie date values. This may lead to application crashes or potentially expose sensitive memory contents. The advisory rates the security impact as important, indicating a significant but not critical risk. No known exploits in the wild have been reported at this time.

Red Hat has released official security updates for libsoup3 in Red Hat Enterprise Linux 10 and its extended update support variants. Users should apply the updates as described in the Red Hat advisory RHSA-2025:18183 and the referenced article https://access.redhat.com/articles/11258 to remediate the vulnerability. Applying these patches will fix the out-of-bounds read issue in the cookie date handling code. No additional mitigation steps are indicated by the vendor.