Skip to content

CVE-2025-11021

Libsoup: out-of-bounds read in cookie date handling of libsoup http library

7.5 HighFix available

A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communication. When processing cookies with specially crafted expiration dates, the library may perform an out-of-bounds memory read. This flaw could result in unintended disclosure of memory contents, potentially exposing sensitive information from the process using libsoup.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.64%Up 0.6 points since Sep 26, 2025

What each source reports

CVE List Score used 7.5

Libsoup: out-of-bounds read in cookie date handling of libsoup http library

A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communication. When processing cookies with specially crafted expiration dates, the library may perform an out-of-bounds memory read. This flaw could result in unintended disclosure of memory contents, potentially exposing sensitive information from the process using libsoup.

Record: CVE-2025-11021
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-125
Updated: 2026-11-02

EUVDEUVD-2025-31225 7.5

A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communication. When processing cookies with specially crafted expiration dates, the library may perform an out-of-bounds memory read. This flaw could result in unintended disclosure of memory contents, potentially exposing sensitive information from the process using libsoup.

Record: EUVD-2025-31225
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-fjfx-vwp2-gqr8 7.5

A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by...

A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communication. When processing cookies with specially crafted expiration dates, the library may perform an out-of-bounds memory read. This flaw could result in unintended disclosure of memory contents, potentially exposing sensitive information from the process using libsoup.

Record: GHSA-fjfx-vwp2-gqr8
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-125
Updated: 2026-11-02

NVD 7.5

A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communication. When processing cookies with specially crafted expiration dates, the library may perform an out-of-bounds memory read. This flaw could result in unintended disclosure of memory contents, potentially exposing sensitive information from the process using libsoup.

Record: CVE-2025-11021
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-125
Updated: 2026-11-02

OSV 7.5

Libsoup: out-of-bounds read in cookie date handling of libsoup http library

A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communication. When processing cookies with specially crafted expiration dates, the library may perform an out-of-bounds memory read. This flaw could result in unintended disclosure of memory contents, potentially exposing sensitive information from the process using libsoup.

Record: CVE-2025-11021
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-125
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-11021 7.5

A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communication. When processing cookies with specially crafted expiration dates, the library may perform an out-of-bounds memory read. This flaw could result in unintended disclosure of memory contents, potentially exposing sensitive information from the process using libsoup.

Record: DEBIAN-CVE-2025-11021
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

Show 38 moreShow less

OSVRHSA-2025:18183 7.5

Red Hat Security Advisory: libsoup3 security update

Record: RHSA-2025:18183
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2025:19713 7.5

Red Hat Security Advisory: libsoup security update

Record: RHSA-2025:19713
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2025:19714 7.5

Red Hat Security Advisory: libsoup security update

Record: RHSA-2025:19714
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2025:20959 7.5

Red Hat Security Advisory: libsoup security update

Record: RHSA-2025:20959
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2025:21032 7.5

Red Hat Security Advisory: libsoup3 security update

Record: RHSA-2025:21032
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2025:21655 7.5

Red Hat Security Advisory: libsoup security update

Record: RHSA-2025:21655
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2025:21656 7.5

Red Hat Security Advisory: libsoup security update

Record: RHSA-2025:21656
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2025:21657 9.0

Red Hat Security Advisory: libsoup security update

Record: RHSA-2025:21657
CVSS 3.1: 9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2025:21664 7.5

Red Hat Security Advisory: libsoup security update

Record: RHSA-2025:21664
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2025:21665 7.5

Red Hat Security Advisory: libsoup security update

Record: RHSA-2025:21665
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2025:21666 7.5

Red Hat Security Advisory: libsoup security update

Record: RHSA-2025:21666
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2025:21772 7.5

Red Hat Security Advisory: libsoup security update

Record: RHSA-2025:21772
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2025:22013 7.5

Red Hat Security Advisory: libsoup security update

Record: RHSA-2025:22013
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVRLSA-2025:18183 7.5

Important: libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

libsoup: Out-of-Bounds Read in Cookie Date Handling of libsoup HTTP Library (CVE-2025-11021)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2025:18183
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVRLSA-2025:19713 7.5

Important: libsoup security update

The libsoup packages provide an HTTP client and server library for GNOME.

Security Fix(es):

libsoup: Integer Overflow in Cookie Expiration Date Handling in libsoup (CVE-2025-4945)
libsoup: Out-of-Bounds Read in Cookie Date Handling of libsoup HTTP Library (CVE-2025-11021)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2025:19713
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVRLSA-2025:19714 7.5

Important: libsoup security update

The libsoup packages provide an HTTP client and server library for GNOME.

Security Fix(es):

libsoup: Integer Overflow in Cookie Expiration Date Handling in libsoup (CVE-2025-4945)
libsoup: Out-of-Bounds Read in Cookie Date Handling of libsoup HTTP Library (CVE-2025-11021)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2025:19714
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVRLSA-2025:20959 7.5

Important: libsoup security update

The libsoup packages provide an HTTP client and server library for GNOME.

Security Fix(es):

libsoup: Integer Overflow in Cookie Expiration Date Handling in libsoup (CVE-2025-4945)
libsoup: Out-of-Bounds Read in Cookie Date Handling of libsoup HTTP Library (CVE-2025-11021)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2025:20959
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVRLSA-2025:21032 7.5

Important: libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

libsoup: Integer Overflow in Cookie Expiration Date Handling in libsoup (CVE-2025-4945)
libsoup: Out-of-Bounds Read in Cookie Date Handling of libsoup HTTP Library (CVE-2025-11021)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2025:21032
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-11021 7.5

A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communication. When processing cookies with specially crafted expiration dates, the library may perform an out-of-bounds memory read. This flaw could result in unintended disclosure of memory contents, potentially exposing sensitive information from the process using libsoup.

Record: UBUNTU-CVE-2025-11021
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVALSA-2025:18183 No score

Important: libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

libsoup: Out-of-Bounds Read in Cookie Date Handling of libsoup HTTP Library (CVE-2025-11021)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2025:18183
Updated: 2026-11-02

OSVALSA-2025:19714 No score

Important: libsoup security update

The libsoup packages provide an HTTP client and server library for GNOME.

Security Fix(es):

libsoup: Integer Overflow in Cookie Expiration Date Handling in libsoup (CVE-2025-4945)
libsoup: Out-of-Bounds Read in Cookie Date Handling of libsoup HTTP Library (CVE-2025-11021)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2025:19714
Updated: 2026-11-02

OSVALSA-2025:20959 No score

Important: libsoup security update

The libsoup packages provide an HTTP client and server library for GNOME.

Security Fix(es):

libsoup: Integer Overflow in Cookie Expiration Date Handling in libsoup (CVE-2025-4945)
libsoup: Out-of-Bounds Read in Cookie Date Handling of libsoup HTTP Library (CVE-2025-11021)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2025:20959
Updated: 2026-11-02

OSVALSA-2025:21032 No score

Important: libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

libsoup: Integer Overflow in Cookie Expiration Date Handling in libsoup (CVE-2025-4945)
libsoup: Out-of-Bounds Read in Cookie Date Handling of libsoup HTTP Library (CVE-2025-11021)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2025:21032
Updated: 2026-11-02

OSVAZL-67860 No score

CVE-2025-11021 affecting package libsoup for versions less than 3.0.4-10

A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communication. When processing cookies with specially crafted expiration dates, the library may perform an out-of-bounds memory read. This flaw could result in unintended disclosure of memory contents, potentially exposing sensitive information from the process using libsoup.

Record: AZL-67860
Updated: 2026-11-02

OSVAZL-67875 No score

CVE-2025-11021 affecting package libsoup for versions less than 3.4.4-10

A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communication. When processing cookies with specially crafted expiration dates, the library may perform an out-of-bounds memory read. This flaw could result in unintended disclosure of memory contents, potentially exposing sensitive information from the process using libsoup.

Record: AZL-67875
Updated: 2026-11-02

OSVCLSA-2025-1763648370 No score

libsoup: Fix of 2 CVEs

CVE-2025-4945: fix integer overflow vulnerability in date/time parsing
CVE-2025-11021: fix out-of-bounds memory read in cookie date handling logic

Record: CLSA-2025-1763648370
Updated: 2026-11-02

OSVCLSA-2025-1764677929 No score

libsoup: Fix of 2 CVEs

CVE-2025-4945: fix integer overflow vulnerability in date/time parsing
CVE-2025-11021: fix out-of-bounds memory read in cookie date handling logic

Record: CLSA-2025-1764677929
Updated: 2026-11-02

OSVCLSA-2025-1764678192 No score

libsoup: Fix of 2 CVEs

CVE-2025-4945: fix integer overflow vulnerability in date/time parsing
CVE-2025-11021: fix out-of-bounds memory read in cookie date handling logic

Record: CLSA-2025-1764678192
Updated: 2026-11-02

OSVCLSA-2025-1764769161 No score

libsoup: Fix of 2 CVEs

CVE-2025-4945: fix integer overflow vulnerability in date/time parsing
CVE-2025-11021: fix out-of-bounds memory read in cookie date handling logic

Record: CLSA-2025-1764769161
Updated: 2026-11-02

OSVopenSUSE-SU-2025:15633-1 No score

libsoup-3_0-0-3.6.5-7.1 on GA media

These are all security issues fixed in the libsoup-3_0-0-3.6.5-7.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2025:15633-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:20142-1 No score

Security update for libsoup

This update for libsoup fixes the following issues:

CVE-2025-11021: Fixed out-of-bounds read in Cookie Date Handling of libsoup HTTP Library (bsc#1250562).
CVE-2026-0719: Fixed stack-based buffer overflow in NTLM authentication can lead to arbitrary code execution (bsc#1256399).
CVE-2026-0716: Fixed improper bounds handling may allow out-of-bounds read (bsc#1256418).

Record: openSUSE-SU-2026:20142-1
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-13-CVE-2025-11021 No score

CVE-2025-11021 in libsoup3 - Patched by Root

Root has patched CVE-2025-11021 in the libsoup3 package for Root:Debian:13. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-13-CVE-2025-11021
Updated: 2026-11-04

OSVSUSE-SU-2025:20937-1 No score

Security update for libsoup

This update for libsoup fixes the following issues:

CVE-2025-11021: Ignore invalid date when processing cookies to prevent out-of-bounds read (bsc#1250562).

Record: SUSE-SU-2025:20937-1
Updated: 2026-11-02

OSVSUSE-SU-2025:20965-1 No score

Security update for libsoup

This update for libsoup fixes the following issues:

CVE-2025-11021: Ignore invalid date when processing cookies to prevent out-of-bounds read (bsc#1250562).

Record: SUSE-SU-2025:20965-1
Updated: 2026-11-02

OSVSUSE-SU-2025:3752-1 No score

Security update for libsoup

This update for libsoup fixes the following issues:

CVE-2025-11021: Ignored invalid date when processing cookies to prevent out-of-bounds read (bsc#1250562).

Record: SUSE-SU-2025:3752-1
Updated: 2026-11-02

OSVSUSE-SU-2025:3753-1 No score

Security update for libsoup

This update for libsoup fixes the following issues:

CVE-2025-11021: Ignored invalid date when processing cookies to prevent out-of-bounds read (bsc#1250562).

Record: SUSE-SU-2025:3753-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20205-1 No score

Security update for libsoup

This update for libsoup fixes the following issues:

CVE-2025-11021: Fixed out-of-bounds read in Cookie Date Handling of libsoup HTTP Library (bsc#1250562).
CVE-2026-0719: Fixed stack-based buffer overflow in NTLM authentication can lead to arbitrary code execution (bsc#1256399).
CVE-2026-0716: Fixed improper bounds handling may allow out-of-bounds read (bsc#1256418).

Record: SUSE-SU-2026:20205-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20212-1 No score

Security update for libsoup

This update for libsoup fixes the following issues:

CVE-2025-11021: Fixed out-of-bounds read in Cookie Date Handling of libsoup HTTP Library (bsc#1250562).
CVE-2026-0719: Fixed stack-based buffer overflow in NTLM authentication can lead to arbitrary code execution (bsc#1256399).
CVE-2026-0716: Fixed improper bounds handling may allow out-of-bounds read (bsc#1256418).

Record: SUSE-SU-2026:20212-1
Updated: 2026-11-02

Affected products

Show 3 moreShow less

Affected packages

Affected packages
Package	Affected	Fixed
`libsoup3-doc` AlmaLinux:10	before 3.6.5-3.el10_0.7	3.6.5-3.el10_0.7
`libsoup` AlmaLinux:8	before 2.62.3-10.el8_10	2.62.3-10.el8_10
`libsoup-devel` AlmaLinux:8	before 2.62.3-10.el8_10	2.62.3-10.el8_10
`libsoup` AlmaLinux:9	before 2.72.0-12.el9_7.1	2.72.0-12.el9_7.1
`libsoup-devel` AlmaLinux:9	before 2.72.0-12.el9_7.1	2.72.0-12.el9_7.1
`libsoup3` AlmaLinux:10	before 3.6.5-3.el10_1.6	3.6.5-3.el10_1.6
`libsoup3-devel` AlmaLinux:10	before 3.6.5-3.el10_1.6	3.6.5-3.el10_1.6
`libsoup3-doc` AlmaLinux:10	before 3.6.5-3.el10_1.6	3.6.5-3.el10_1.6
`libsoup` Azure Linux:2	before 3.0.4-10	3.0.4-10
`libsoup` Azure Linux:3	before 3.4.4-10	3.4.4-10

Show 129 moreShow less

Affected packages
Package	Affected	Fixed
`libsoup` TuxCare:AlmaLinux:9.2	before 2.72.0-8.el9_2.tuxcare.els10	2.72.0-8.el9_2.tuxcare.els10
`libsoup-devel` TuxCare:AlmaLinux:9.2	before 2.72.0-8.el9_2.tuxcare.els10	2.72.0-8.el9_2.tuxcare.els10
`libsoup-doc` TuxCare:AlmaLinux:9.2	before 2.72.0-8.el9_2.tuxcare.els10	2.72.0-8.el9_2.tuxcare.els10
`libsoup` TuxCare:OracleLinux:7	before 2.62.2-2.0.5.el7.tuxcare.els2	2.62.2-2.0.5.el7.tuxcare.els2
`libsoup-devel` TuxCare:OracleLinux:7	before 2.62.2-2.0.5.el7.tuxcare.els2	2.62.2-2.0.5.el7.tuxcare.els2
`libsoup` TuxCare:RHEL:7	before 2.62.2-2.0.5.el7.tuxcare.els2	2.62.2-2.0.5.el7.tuxcare.els2
`libsoup-devel` TuxCare:RHEL:7	before 2.62.2-2.0.5.el7.tuxcare.els2	2.62.2-2.0.5.el7.tuxcare.els2
`libsoup` TuxCare:CentOS:7	before 2.62.2-2.0.5.el7.tuxcare.els2	2.62.2-2.0.5.el7.tuxcare.els2
`libsoup-devel` TuxCare:CentOS:7	before 2.62.2-2.0.5.el7.tuxcare.els2	2.62.2-2.0.5.el7.tuxcare.els2
`libsoup3` Debian:12	All versions, plus listed versions 3.2.2-23.2.3-0+deb12u13.2.3-0+deb12u23.3.1-13.4.0-1 Show 33 moreShow less 3.4.1-13.4.2-13.4.2-23.4.2-33.4.2-43.4.3-13.4.4-13.4.4-23.4.4-33.4.4-43.4.4-53.5.2-13.6.0-13.6.0-23.6.0-33.6.0-43.6.1-13.6.4-13.6.4-23.6.4-33.6.5-13.6.5-23.6.5-33.6.5-43.6.5-53.6.5-63.6.5-73.6.5-83.6.5-93.6.6-13.8.0-13.8.0-23.8.0-3	None known
`libsoup3` Debian:13	All versions, plus listed versions 3.6.5-33.6.5-43.6.5-53.6.5-63.6.5-7 Show 6 moreShow less 3.6.5-83.6.5-93.6.6-13.8.0-13.8.0-23.8.0-3	None known
`libsoup3` Red Hat:enterprise_linux:10.0	before 0:3.6.5-3.el10_0.7	0:3.6.5-3.el10_0.7
`libsoup3-debuginfo` Red Hat:enterprise_linux:10.0	before 0:3.6.5-3.el10_0.7	0:3.6.5-3.el10_0.7
`libsoup3-debugsource` Red Hat:enterprise_linux:10.0	before 0:3.6.5-3.el10_0.7	0:3.6.5-3.el10_0.7
`libsoup3-devel` Red Hat:enterprise_linux:10.0	before 0:3.6.5-3.el10_0.7	0:3.6.5-3.el10_0.7
`libsoup3-doc` Red Hat:enterprise_linux:10.0	before 0:3.6.5-3.el10_0.7	0:3.6.5-3.el10_0.7
`libsoup` Red Hat:enterprise_linux:9::appstream	before 0:2.72.0-10.el9_6.3	0:2.72.0-10.el9_6.3
`libsoup-debuginfo` Red Hat:enterprise_linux:9::appstream	before 0:2.72.0-10.el9_6.3	0:2.72.0-10.el9_6.3
`libsoup-debugsource` Red Hat:enterprise_linux:9::appstream	before 0:2.72.0-10.el9_6.3	0:2.72.0-10.el9_6.3
`libsoup-devel` Red Hat:enterprise_linux:9::appstream	before 0:2.72.0-10.el9_6.3	0:2.72.0-10.el9_6.3
`libsoup-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:2.62.3-10.el8_10	0:2.62.3-10.el8_10
`libsoup-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:2.62.3-10.el8_10	0:2.62.3-10.el8_10
`libsoup-devel` Red Hat:enterprise_linux:8::appstream	before 0:2.62.3-10.el8_10	0:2.62.3-10.el8_10
`libsoup` Red Hat:enterprise_linux:8::baseos	before 0:2.62.3-10.el8_10	0:2.62.3-10.el8_10
`libsoup-debuginfo` Red Hat:enterprise_linux:8::baseos	before 0:2.62.3-10.el8_10	0:2.62.3-10.el8_10
`libsoup-debugsource` Red Hat:enterprise_linux:8::baseos	before 0:2.62.3-10.el8_10	0:2.62.3-10.el8_10
`libsoup` Red Hat:enterprise_linux:9::appstream	before 0:2.72.0-12.el9_7.1	0:2.72.0-12.el9_7.1
`libsoup-debuginfo` Red Hat:enterprise_linux:9::appstream	before 0:2.72.0-12.el9_7.1	0:2.72.0-12.el9_7.1
`libsoup-debugsource` Red Hat:enterprise_linux:9::appstream	before 0:2.72.0-12.el9_7.1	0:2.72.0-12.el9_7.1
`libsoup-devel` Red Hat:enterprise_linux:9::appstream	before 0:2.72.0-12.el9_7.1	0:2.72.0-12.el9_7.1
`libsoup3` Red Hat:enterprise_linux:10.1	before 0:3.6.5-3.el10_1.6	0:3.6.5-3.el10_1.6
`libsoup3-debuginfo` Red Hat:enterprise_linux:10.1	before 0:3.6.5-3.el10_1.6	0:3.6.5-3.el10_1.6
`libsoup3-debugsource` Red Hat:enterprise_linux:10.1	before 0:3.6.5-3.el10_1.6	0:3.6.5-3.el10_1.6
`libsoup3-devel` Red Hat:enterprise_linux:10.1	before 0:3.6.5-3.el10_1.6	0:3.6.5-3.el10_1.6
`libsoup3-doc` Red Hat:enterprise_linux:10.1	before 0:3.6.5-3.el10_1.6	0:3.6.5-3.el10_1.6
`libsoup` Red Hat:rhel_e4s:9.2::appstream	before 0:2.72.0-8.el9_2.6	0:2.72.0-8.el9_2.6
`libsoup-debuginfo` Red Hat:rhel_e4s:9.2::appstream	before 0:2.72.0-8.el9_2.6	0:2.72.0-8.el9_2.6
`libsoup-debugsource` Red Hat:rhel_e4s:9.2::appstream	before 0:2.72.0-8.el9_2.6	0:2.72.0-8.el9_2.6
`libsoup-devel` Red Hat:rhel_e4s:9.2::appstream	before 0:2.72.0-8.el9_2.6	0:2.72.0-8.el9_2.6
`libsoup` Red Hat:rhel_e4s:9.0::appstream	before 0:2.72.0-8.el9_0.6	0:2.72.0-8.el9_0.6
`libsoup-debuginfo` Red Hat:rhel_e4s:9.0::appstream	before 0:2.72.0-8.el9_0.6	0:2.72.0-8.el9_0.6
`libsoup-debugsource` Red Hat:rhel_e4s:9.0::appstream	before 0:2.72.0-8.el9_0.6	0:2.72.0-8.el9_0.6
`libsoup-devel` Red Hat:rhel_e4s:9.0::appstream	before 0:2.72.0-8.el9_0.6	0:2.72.0-8.el9_0.6
`libsoup` Red Hat:rhel_els:7	before 0:2.62.2-9.el7_9	0:2.62.2-9.el7_9
`libsoup-debuginfo` Red Hat:rhel_els:7	before 0:2.62.2-9.el7_9	0:2.62.2-9.el7_9
`libsoup-devel` Red Hat:rhel_els:7	before 0:2.62.2-9.el7_9	0:2.62.2-9.el7_9
`libsoup-debuginfo` Red Hat:rhel_aus:8.6::appstream	before 0:2.62.3-2.el8_6.6	0:2.62.3-2.el8_6.6
`libsoup-debugsource` Red Hat:rhel_aus:8.6::appstream	before 0:2.62.3-2.el8_6.6	0:2.62.3-2.el8_6.6
`libsoup-devel` Red Hat:rhel_aus:8.6::appstream	before 0:2.62.3-2.el8_6.6	0:2.62.3-2.el8_6.6
`libsoup-debuginfo` Red Hat:rhel_e4s:8.6::appstream	before 0:2.62.3-2.el8_6.6	0:2.62.3-2.el8_6.6
`libsoup-debugsource` Red Hat:rhel_e4s:8.6::appstream	before 0:2.62.3-2.el8_6.6	0:2.62.3-2.el8_6.6
`libsoup-devel` Red Hat:rhel_e4s:8.6::appstream	before 0:2.62.3-2.el8_6.6	0:2.62.3-2.el8_6.6
`libsoup-debuginfo` Red Hat:rhel_tus:8.6::appstream	before 0:2.62.3-2.el8_6.6	0:2.62.3-2.el8_6.6
`libsoup-debugsource` Red Hat:rhel_tus:8.6::appstream	before 0:2.62.3-2.el8_6.6	0:2.62.3-2.el8_6.6
`libsoup-devel` Red Hat:rhel_tus:8.6::appstream	before 0:2.62.3-2.el8_6.6	0:2.62.3-2.el8_6.6
`libsoup` Red Hat:rhel_aus:8.6::baseos	before 0:2.62.3-2.el8_6.6	0:2.62.3-2.el8_6.6
`libsoup-debuginfo` Red Hat:rhel_aus:8.6::baseos	before 0:2.62.3-2.el8_6.6	0:2.62.3-2.el8_6.6
`libsoup-debugsource` Red Hat:rhel_aus:8.6::baseos	before 0:2.62.3-2.el8_6.6	0:2.62.3-2.el8_6.6
`libsoup` Red Hat:rhel_e4s:8.6::baseos	before 0:2.62.3-2.el8_6.6	0:2.62.3-2.el8_6.6
`libsoup-debuginfo` Red Hat:rhel_e4s:8.6::baseos	before 0:2.62.3-2.el8_6.6	0:2.62.3-2.el8_6.6
`libsoup-debugsource` Red Hat:rhel_e4s:8.6::baseos	before 0:2.62.3-2.el8_6.6	0:2.62.3-2.el8_6.6
`libsoup` Red Hat:rhel_tus:8.6::baseos	before 0:2.62.3-2.el8_6.6	0:2.62.3-2.el8_6.6
`libsoup-debuginfo` Red Hat:rhel_tus:8.6::baseos	before 0:2.62.3-2.el8_6.6	0:2.62.3-2.el8_6.6
`libsoup-debugsource` Red Hat:rhel_tus:8.6::baseos	before 0:2.62.3-2.el8_6.6	0:2.62.3-2.el8_6.6
`libsoup-debuginfo` Red Hat:rhel_e4s:8.8::appstream	before 0:2.62.3-3.el8_8.6	0:2.62.3-3.el8_8.6
`libsoup-debugsource` Red Hat:rhel_e4s:8.8::appstream	before 0:2.62.3-3.el8_8.6	0:2.62.3-3.el8_8.6
`libsoup-devel` Red Hat:rhel_e4s:8.8::appstream	before 0:2.62.3-3.el8_8.6	0:2.62.3-3.el8_8.6
`libsoup` Red Hat:rhel_e4s:8.8::baseos	before 0:2.62.3-3.el8_8.6	0:2.62.3-3.el8_8.6
`libsoup-debuginfo` Red Hat:rhel_e4s:8.8::baseos	before 0:2.62.3-3.el8_8.6	0:2.62.3-3.el8_8.6
`libsoup-debugsource` Red Hat:rhel_e4s:8.8::baseos	before 0:2.62.3-3.el8_8.6	0:2.62.3-3.el8_8.6
`libsoup` Red Hat:rhel_eus:9.4::appstream	before 0:2.72.0-8.el9_4.6	0:2.72.0-8.el9_4.6
`libsoup-debuginfo` Red Hat:rhel_eus:9.4::appstream	before 0:2.72.0-8.el9_4.6	0:2.72.0-8.el9_4.6
`libsoup-debugsource` Red Hat:rhel_eus:9.4::appstream	before 0:2.72.0-8.el9_4.6	0:2.72.0-8.el9_4.6
`libsoup-devel` Red Hat:rhel_eus:9.4::appstream	before 0:2.72.0-8.el9_4.6	0:2.72.0-8.el9_4.6
`libsoup-debuginfo` Red Hat:rhel_aus:8.4::appstream	before 0:2.62.3-2.el8_4.6	0:2.62.3-2.el8_4.6
`libsoup-debugsource` Red Hat:rhel_aus:8.4::appstream	before 0:2.62.3-2.el8_4.6	0:2.62.3-2.el8_4.6
`libsoup-devel` Red Hat:rhel_aus:8.4::appstream	before 0:2.62.3-2.el8_4.6	0:2.62.3-2.el8_4.6
`libsoup-debuginfo` Red Hat:rhel_eus_long_life:8.4::appstream	before 0:2.62.3-2.el8_4.6	0:2.62.3-2.el8_4.6
`libsoup-debugsource` Red Hat:rhel_eus_long_life:8.4::appstream	before 0:2.62.3-2.el8_4.6	0:2.62.3-2.el8_4.6
`libsoup-devel` Red Hat:rhel_eus_long_life:8.4::appstream	before 0:2.62.3-2.el8_4.6	0:2.62.3-2.el8_4.6
`libsoup` Red Hat:rhel_aus:8.4::baseos	before 0:2.62.3-2.el8_4.6	0:2.62.3-2.el8_4.6
`libsoup-debuginfo` Red Hat:rhel_aus:8.4::baseos	before 0:2.62.3-2.el8_4.6	0:2.62.3-2.el8_4.6
`libsoup-debugsource` Red Hat:rhel_aus:8.4::baseos	before 0:2.62.3-2.el8_4.6	0:2.62.3-2.el8_4.6
`libsoup` Red Hat:rhel_eus_long_life:8.4::baseos	before 0:2.62.3-2.el8_4.6	0:2.62.3-2.el8_4.6
`libsoup-debuginfo` Red Hat:rhel_eus_long_life:8.4::baseos	before 0:2.62.3-2.el8_4.6	0:2.62.3-2.el8_4.6
`libsoup-debugsource` Red Hat:rhel_eus_long_life:8.4::baseos	before 0:2.62.3-2.el8_4.6	0:2.62.3-2.el8_4.6
`libsoup-debuginfo` Red Hat:rhel_aus:8.2::appstream	before 0:2.62.3-1.el8_2.6	0:2.62.3-1.el8_2.6
`libsoup-debugsource` Red Hat:rhel_aus:8.2::appstream	before 0:2.62.3-1.el8_2.6	0:2.62.3-1.el8_2.6
`libsoup-devel` Red Hat:rhel_aus:8.2::appstream	before 0:2.62.3-1.el8_2.6	0:2.62.3-1.el8_2.6
`libsoup` Red Hat:rhel_aus:8.2::baseos	before 0:2.62.3-1.el8_2.6	0:2.62.3-1.el8_2.6
`libsoup-debuginfo` Red Hat:rhel_aus:8.2::baseos	before 0:2.62.3-1.el8_2.6	0:2.62.3-1.el8_2.6
`libsoup-debugsource` Red Hat:rhel_aus:8.2::baseos	before 0:2.62.3-1.el8_2.6	0:2.62.3-1.el8_2.6
`libsoup3` Rocky Linux:10	before 0:3.6.5-3.el10_0.7	0:3.6.5-3.el10_0.7
`libsoup` Rocky Linux:9	before 0:2.72.0-10.el9_6.3	0:2.72.0-10.el9_6.3
`libsoup` Rocky Linux:8	before 0:2.62.3-10.el8_10	0:2.62.3-10.el8_10
`libsoup` Rocky Linux:9	before 0:2.72.0-12.el9_7.1	0:2.72.0-12.el9_7.1
`libsoup3` Rocky Linux:10	before 0:3.6.5-3.el10_1.6	0:3.6.5-3.el10_1.6
`libsoup3` Root:Debian:13	before 3.6.5-3.aikido.4	3.6.5-3.aikido.43.6.5-3.aikido.33.6.5-3.root.io.13.6.5-3.root.io.23.6.5-3.aikido.53.6.5-3.aikido.63.6.5-3.aikido.73.6.5-3.aikido.83.6.5-3.aikido.9
`rootio-libsoup3` Root:Debian:13	before 3.6.5-3.aikido.4	3.6.5-3.aikido.43.6.5-3.aikido.33.6.5-3.root.io.13.6.5-3.root.io.23.6.5-3.aikido.53.6.5-3.aikido.63.6.5-3.aikido.73.6.5-3.aikido.83.6.5-3.aikido.9
`libsoup` SUSE:Linux Micro 6.0	before 3.4.2-9.1	3.4.2-9.1
`libsoup` SUSE:Linux Micro 6.1	before 3.4.4-slfo.1.1_5.1	3.4.4-slfo.1.1_5.1
`libsoup` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS	before 3.0.4-150400.3.18.1	3.0.4-150400.3.18.1
`libsoup` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS	before 3.0.4-150400.3.18.1	3.0.4-150400.3.18.1
`libsoup` SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS	before 3.0.4-150400.3.18.1	3.0.4-150400.3.18.1
`libsoup` SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS	before 3.0.4-150400.3.18.1	3.0.4-150400.3.18.1
`libsoup` SUSE:Linux Enterprise Server 15 SP4-LTSS	before 3.0.4-150400.3.18.1	3.0.4-150400.3.18.1
`libsoup` SUSE:Linux Enterprise Server 15 SP5-LTSS	before 3.0.4-150400.3.18.1	3.0.4-150400.3.18.1
`libsoup` SUSE:Linux Enterprise Server for SAP Applications 15 SP4	before 3.0.4-150400.3.18.1	3.0.4-150400.3.18.1
`libsoup` SUSE:Linux Enterprise Server for SAP Applications 15 SP5	before 3.0.4-150400.3.18.1	3.0.4-150400.3.18.1
`libsoup` SUSE:Manager Proxy LTS 4.3	before 3.0.4-150400.3.18.1	3.0.4-150400.3.18.1
`libsoup` SUSE:Manager Server LTS 4.3	before 3.0.4-150400.3.18.1	3.0.4-150400.3.18.1
`libsoup` SUSE:Linux Enterprise Module for Basesystem 15 SP6	before 3.4.4-150600.3.18.1	3.4.4-150600.3.18.1
`libsoup` SUSE:Linux Enterprise Module for Basesystem 15 SP7	before 3.4.4-150600.3.18.1	3.4.4-150600.3.18.1
`libsoup` openSUSE:Leap 15.6	before 3.4.4-150600.3.18.1	3.4.4-150600.3.18.1
`libsoup` SUSE:Linux Micro 6.2	before 3.6.5-160000.3.1	3.6.5-160000.3.1
`libsoup` SUSE:Linux Enterprise Server 16.0	before 3.6.5-160000.3.1	3.6.5-160000.3.1
`libsoup` SUSE:Linux Enterprise Server for SAP applications 16.0	before 3.6.5-160000.3.1	3.6.5-160000.3.1
`libsoup2.4` Ubuntu:Pro:16.04:LTS	before 2.52.2-1ubuntu0.3+esm5, plus listed versions 2.50.0-2debian12.52.1-12.52.2-12.52.2-1ubuntu0.12.52.2-1ubuntu0.2 Show 5 moreShow less 2.52.2-1ubuntu0.32.52.2-1ubuntu0.3+esm12.52.2-1ubuntu0.3+esm22.52.2-1ubuntu0.3+esm32.52.2-1ubuntu0.3+esm4	2.52.2-1ubuntu0.3+esm5
`libsoup2.4` Ubuntu:Pro:18.04:LTS	before 2.62.1-1ubuntu0.4+esm6, plus listed versions 2.60.1-12.60.2-12.60.2-22.60.3-12.61.90-1 Show 10 moreShow less 2.62.0-12.62.1-12.62.1-1ubuntu0.12.62.1-1ubuntu0.32.62.1-1ubuntu0.42.62.1-1ubuntu0.4+esm12.62.1-1ubuntu0.4+esm22.62.1-1ubuntu0.4+esm32.62.1-1ubuntu0.4+esm42.62.1-1ubuntu0.4+esm5	2.62.1-1ubuntu0.4+esm6
`libsoup2.4` Ubuntu:Pro:20.04:LTS	before 2.70.0-1ubuntu0.5+esm1, plus listed versions 2.68.2-0ubuntu12.68.2-12.68.2-22.68.2-2build22.69.90-1 Show 6 moreShow less 2.70.0-12.70.0-1ubuntu0.12.70.0-1ubuntu0.22.70.0-1ubuntu0.32.70.0-1ubuntu0.42.70.0-1ubuntu0.5	2.70.0-1ubuntu0.5+esm1
`libsoup2.4` Ubuntu:22.04:LTS	before 2.74.2-3ubuntu0.6, plus listed versions 2.72.0-3ubuntu32.74.1-12.74.2-22.74.2-32.74.2-3ubuntu0.1 Show 4 moreShow less 2.74.2-3ubuntu0.22.74.2-3ubuntu0.32.74.2-3ubuntu0.42.74.2-3ubuntu0.5	2.74.2-3ubuntu0.6
`libsoup3` Ubuntu:Pro:22.04:LTS	before 3.0.7-0ubuntu1+esm5, plus listed versions 3.0.4-23.0.4-33.0.5-13.0.7-0ubuntu13.0.7-0ubuntu1+esm13.0.7-0ubuntu1+esm23.0.7-0ubuntu1+esm33.0.7-0ubuntu1+esm4	3.0.7-0ubuntu1+esm5
`libsoup2.4` Ubuntu:24.04:LTS	before 2.74.3-6ubuntu1.6, plus listed versions 2.74.3-12.74.3-22.74.3-32.74.3-62.74.3-6build1 Show 6 moreShow less 2.74.3-6ubuntu12.74.3-6ubuntu1.12.74.3-6ubuntu1.22.74.3-6ubuntu1.32.74.3-6ubuntu1.42.74.3-6ubuntu1.5	2.74.3-6ubuntu1.6
`libsoup3` Ubuntu:24.04:LTS	before 3.4.4-5ubuntu0.5, plus listed versions 3.4.2-43.4.4-13.4.4-23.4.4-43.4.4-5 Show 6 moreShow less 3.4.4-5build13.4.4-5build23.4.4-5ubuntu0.13.4.4-5ubuntu0.23.4.4-5ubuntu0.33.4.4-5ubuntu0.4	3.4.4-5ubuntu0.5
`libsoup2.4` Ubuntu:25.10	before 2.74.3-10.1ubuntu4, plus listed versions 2.74.3-102.74.3-10.12.74.3-10.1ubuntu12.74.3-10.1ubuntu22.74.3-10.1ubuntu3	2.74.3-10.1ubuntu4
`libsoup3` Ubuntu:25.10	before 3.6.5-3, plus listed versions 3.6.5-13.6.5-1ubuntu1	3.6.5-3
`libsoup2.4` Ubuntu:26.04:LTS	before 2.74.3-10.1ubuntu4	2.74.3-10.1ubuntu4
`libsoup` openSUSE:Tumbleweed	before 3.6.5-7.1	3.6.5-7.1
`libsoup` openSUSE:Leap 16.0	before 3.6.5-160000.3.1	3.6.5-160000.3.1

History

History
Recorded	Changed	Sources
Nov 4, 2026	affected, facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-11021 is a high vulnerability (CVSS 7.5) in Red Hat Enterprise Linux 10, published September 26, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.64%, the 50th percentile. Fixed in libsoup3-doc 3.6.5-3.el10_0.7.

References

Show 100 moreShow less