CVE-2025-9901
Libsoup: improper handling of http vary header in libsoup caching
A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information. While the issue is unlikely to affect everyday desktop use, it could result in confidentiality breaches in proxy or multi-user environments.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
5.9
Libsoup: improper handling of http vary header in libsoup caching
A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information. While the issue is unlikely to affect everyday desktop use, it could result in confidentiality breaches in proxy or multi-user environments.
- Record
CVE-2025-9901- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-524
- Updated
- 2026-11-05
EUVDEUVD-2025-26502
5.9
A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information. While the issue is unlikely to affect everyday desktop use, it could result in confidentiality breaches in proxy or multi-user environments.
- Record
EUVD-2025-26502- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-hxjp-2xf5-wmrj
5.9
A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored...
A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information. While the issue is unlikely to affect everyday desktop use, it could result in confidentiality breaches in proxy or multi-user environments.
- Record
GHSA-hxjp-2xf5-wmrj- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-524
- Updated
- 2026-11-02
NVD
5.9
A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information. While the issue is unlikely to affect everyday desktop use, it could result in confidentiality breaches in proxy or multi-user environments.
- Record
CVE-2025-9901- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-524
- Updated
- 2026-11-05
OSV
5.9
A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information. While the issue is unlikely to affect everyday desktop use, it could result in confidentiality breaches in proxy or multi-user environments.
- Record
CVE-2025-9901- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-9901
5.9
A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information. While the issue is unlikely to affect everyday desktop use, it could result in confidentiality breaches in proxy or multi-user environments.
- Record
DEBIAN-CVE-2025-9901- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-9901
5.9
A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information. While the issue is unlikely to affect everyday desktop use, it could result in confidentiality breaches in proxy or multi-user environments.
- Record
UBUNTU-CVE-2025-9901- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
OSVAZL-67058 No score
CVE-2025-9901 affecting package libsoup 3.4.4-18
A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information. While the issue is unlikely to affect everyday desktop use, it could result in confidentiality breaches in proxy or multi-user environments.
- Record
AZL-67058- Updated
- 2026-11-05
OSVAZL-67061 No score
CVE-2025-9901 affecting package libsoup 3.0.4-12
A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information. While the issue is unlikely to affect everyday desktop use, it could result in confidentiality breaches in proxy or multi-user environments.
- Record
AZL-67061- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libsoupAzure Linux:3 |
through 3.4.4-18 | None known |
libsoupAzure Linux:2 |
through 3.0.4-12 | None known |
libsoupDebian:14 |
All versions, plus listed versions 2.1.2-12.1.5-12.1.7-12.2.100-12.2.101-1 Show 30 moreShow less2.2.102-12.2.103-12.2.104-12.2.105-12.2.105-22.2.105-32.2.105-42.2.2-12.2.3-12.2.3-22.2.3-2sarge12.2.6-12.2.7-12.2.7-22.2.91-12.2.91-22.2.92-12.2.93-12.2.93-22.2.93-32.2.95.1-12.2.96-12.2.97-12.2.98-12.2.98-22.2.98-2+etch12.2.99-13.8.0-53.8.0-63.8.1-1 |
None known |
libsoup2.4Debian:12 |
All versions, plus listed versions 2.74.3-12.74.3-1+deb12u12.74.3-102.74.3-10.12.74.3-11 Show 11 moreShow less2.74.3-22.74.3-32.74.3-3.1~exp12.74.3-3.1~exp22.74.3-3.1~exp32.74.3-52.74.3-62.74.3-72.74.3-82.74.3-8.12.74.3-9 |
None known |
libsoup2.4Debian:13 |
All versions, plus listed versions 2.74.3-10.12.74.3-11 |
None known |
libsoup3Debian:12 |
All versions, plus listed versions 3.2.2-23.2.3-0+deb12u13.2.3-0+deb12u23.3.1-13.4.0-1 Show 33 moreShow less3.4.1-13.4.2-13.4.2-23.4.2-33.4.2-43.4.3-13.4.4-13.4.4-23.4.4-33.4.4-43.4.4-53.5.2-13.6.0-13.6.0-23.6.0-33.6.0-43.6.1-13.6.4-13.6.4-23.6.4-33.6.5-13.6.5-23.6.5-33.6.5-43.6.5-53.6.5-63.6.5-73.6.5-83.6.5-93.6.6-13.8.0-13.8.0-23.8.0-3 |
None known |
libsoup3Debian:13 |
All versions, plus listed versions 3.6.5-33.6.5-43.6.5-53.6.5-63.6.5-7 Show 6 moreShow less3.6.5-83.6.5-93.6.6-13.8.0-13.8.0-23.8.0-3 |
None known |
libsoup2.4Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.50.0-2debian12.52.1-12.52.2-12.52.2-1ubuntu0.12.52.2-1ubuntu0.2 Show 10 moreShow less2.52.2-1ubuntu0.32.52.2-1ubuntu0.3+esm12.52.2-1ubuntu0.3+esm22.52.2-1ubuntu0.3+esm32.52.2-1ubuntu0.3+esm42.52.2-1ubuntu0.3+esm52.52.2-1ubuntu0.3+esm62.52.2-1ubuntu0.3+esm72.52.2-1ubuntu0.3+esm82.52.2-1ubuntu0.3+esm9 |
None known |
libsoup2.4Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.60.1-12.60.2-12.60.2-22.60.3-12.61.90-1 Show 15 moreShow less2.62.0-12.62.1-12.62.1-1ubuntu0.12.62.1-1ubuntu0.32.62.1-1ubuntu0.42.62.1-1ubuntu0.4+esm12.62.1-1ubuntu0.4+esm22.62.1-1ubuntu0.4+esm32.62.1-1ubuntu0.4+esm42.62.1-1ubuntu0.4+esm52.62.1-1ubuntu0.4+esm62.62.1-1ubuntu0.4+esm72.62.1-1ubuntu0.4+esm82.62.1-1ubuntu0.4+esm92.62.1-1ubuntu0.4+esm10 |
None known |
libsoup2.4Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.68.2-0ubuntu12.68.2-12.68.2-22.68.2-2build22.69.90-1 Show 11 moreShow less2.70.0-12.70.0-1ubuntu0.12.70.0-1ubuntu0.22.70.0-1ubuntu0.32.70.0-1ubuntu0.42.70.0-1ubuntu0.52.70.0-1ubuntu0.5+esm12.70.0-1ubuntu0.5+esm22.70.0-1ubuntu0.5+esm32.70.0-1ubuntu0.5+esm42.70.0-1ubuntu0.5+esm5 |
None known |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libsoup2.4Ubuntu:22.04:LTS |
All versions, plus listed versions 2.72.0-3ubuntu32.74.1-12.74.2-22.74.2-32.74.2-3ubuntu0.1 Show 9 moreShow less2.74.2-3ubuntu0.22.74.2-3ubuntu0.32.74.2-3ubuntu0.42.74.2-3ubuntu0.52.74.2-3ubuntu0.62.74.2-3ubuntu0.72.74.2-3ubuntu0.82.74.2-3ubuntu0.92.74.2-3ubuntu0.10 |
None known |
libsoup3Ubuntu:Pro:22.04:LTS |
All versions, plus listed versions 3.0.4-23.0.4-33.0.5-13.0.7-0ubuntu13.0.7-0ubuntu1+esm1 Show 9 moreShow less3.0.7-0ubuntu1+esm23.0.7-0ubuntu1+esm33.0.7-0ubuntu1+esm43.0.7-0ubuntu1+esm53.0.7-0ubuntu1+esm63.0.7-0ubuntu1+esm73.0.7-0ubuntu1+esm83.0.7-0ubuntu1+esm93.0.7-0ubuntu1+esm10 |
None known |
libsoup2.4Ubuntu:24.04:LTS |
All versions, plus listed versions 2.74.3-12.74.3-22.74.3-32.74.3-62.74.3-6build1 Show 11 moreShow less2.74.3-6ubuntu12.74.3-6ubuntu1.12.74.3-6ubuntu1.22.74.3-6ubuntu1.32.74.3-6ubuntu1.42.74.3-6ubuntu1.52.74.3-6ubuntu1.62.74.3-6ubuntu1.72.74.3-6ubuntu1.82.74.3-6ubuntu1.92.74.3-6ubuntu1.10 |
None known |
libsoup3Ubuntu:24.04:LTS |
All versions, plus listed versions 3.4.2-43.4.4-13.4.4-23.4.4-43.4.4-5 Show 12 moreShow less3.4.4-5build13.4.4-5build23.4.4-5ubuntu0.13.4.4-5ubuntu0.23.4.4-5ubuntu0.33.4.4-5ubuntu0.43.4.4-5ubuntu0.53.4.4-5ubuntu0.63.4.4-5ubuntu0.73.4.4-5ubuntu0.83.4.4-5ubuntu0.93.4.4-5ubuntu0.10 |
None known |
libsoup2.4Ubuntu:25.10 |
All versions, plus listed versions 2.74.3-102.74.3-10.12.74.3-10.1ubuntu12.74.3-10.1ubuntu22.74.3-10.1ubuntu32.74.3-10.1ubuntu42.74.3-10.1ubuntu4.1 |
None known |
libsoup3Ubuntu:25.10 |
All versions, plus listed versions 3.6.5-13.6.5-1ubuntu13.6.5-33.6.5-43.6.5-4ubuntu0.13.6.5-4ubuntu0.2 |
None known |
libsoup2.4Ubuntu:26.10 |
All versions, plus listed versions 2.74.3-10.1ubuntu5 |
None known |
libsoup3Ubuntu:26.10 |
All versions, plus listed versions 3.6.6-13.6.6-1ubuntu33.6.6-1ubuntu3.1 |
None known |
libsoup3Ubuntu:26.04:LTS |
All versions, plus listed versions 3.6.5-43.6.5-53.6.5-63.6.5-73.6.5-93.6.6-13.6.6-1ubuntu0.13.6.6-1ubuntu0.2 |
None known |
libsoup2.4Ubuntu:Pro:26.04:LTS |
All versions, plus listed versions 2.74.3-10.1ubuntu42.74.3-10.1ubuntu52.74.3-10.1ubuntu5+esm12.74.3-10.1ubuntu5+esm22.74.3-10.1ubuntu5+esm32.74.3-10.1ubuntu5+esm4 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-9901 is a medium vulnerability (CVSS 5.9) in Red Hat Enterprise Linux 10, published September 3, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. No source names a fixed version.
References
access.redhat.com/security/cve/CVE-2025-9901
bugzilla.redhat.com/show_bug.cgi?id=2392790
gitlab.gnome.org/GNOME/libsoup/-/issues/453
nvd.nist.gov/vuln/detail/CVE-2025-9901
github.com/advisories/GHSA-hxjp-2xf5-wmrj
security-tracker.debian.org/tracker/CVE-2025-9901
ubuntu.com/security/CVE-2025-9901
cve.org/CVERecord?id=CVE-2025-9901