CVE-2025-4035
Libsoup: cookie domain validation bypass via uppercase characters in libsoup
CVE-2025-4035 is a medium vulnerability (CVSS 4.3) in Red Hat Enterprise Linux 10, published April 29, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 38th percentile. Fixed in libsoup3-doc 3.6.5-3.el10_0.6.
A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Libsoup: cookie domain validation bypass via uppercase characters in libsoup
A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation.
- Record
CVE-2025-4035- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-178
- Updated
- 2026-11-02
EUVDEUVD-2025-15014
A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation.
- Record
EUVD-2025-15014- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9685-44wp-34gm
A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to...
A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation.
- Record
GHSA-9685-44wp-34gm- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-178
- Updated
- 2026-11-02
NVD
A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation.
- Record
CVE-2025-4035- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-178
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-4035
A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation.
- Record
DEBIAN-CVE-2025-4035- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2025:8128
Red Hat Security Advisory: libsoup3 security update
- Record
RHSA-2025:8128- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVRLSA-2025:8128
Important: libsoup3 security update
Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.
Security Fix(es):
-
libsoup: Denial of Service attack to websocket server (CVE-2025-32049)
-
libsoup: Denial of service in server when client requests a large amount of overlapping ranges with Range header (CVE-2025-32907)
-
libsoup: Cookie domain validation bypass via uppercase characters in libsoup (CVE-2025-4035)
-
libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup (CVE-2025-4948)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2025:8128- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-4035
A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation.
- Record
UBUNTU-CVE-2025-4035- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
OSVALSA-2025:8128 No score
Important: libsoup3 security update
Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.
Security Fix(es):
- libsoup: Denial of Service attack to websocket server (CVE-2025-32049)
- libsoup: Denial of service in server when client requests a large amount of overlapping ranges with Range header (CVE-2025-32907)
- libsoup: Cookie domain validation bypass via uppercase characters in libsoup (CVE-2025-4035)
- libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup (CVE-2025-4948)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2025:8128- Updated
- 2026-11-02
OSVAZL-61665 No score
CVE-2025-4035 affecting package libsoup 3.0.4-12
A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation.
- Record
AZL-61665- Updated
- 2026-11-02
OSVAZL-61670 No score
CVE-2025-4035 affecting package libsoup 3.4.4-18
A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation.
- Record
AZL-61670- Updated
- 2026-11-02
OSV No score
A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation.
- Record
CVE-2025-4035- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2025-4035 No score
CVE-2025-4035 in libsoup3 - Patched by Root
Root has patched CVE-2025-4035 in the libsoup3 package for Root:Debian:13. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-13-CVE-2025-4035- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libsoup3-docAlmaLinux:10 |
before 3.6.5-3.el10_0.6 | 3.6.5-3.el10_0.6 |
libsoupAzure Linux:2 |
through 3.0.4-12 | None known |
libsoupAzure Linux:3 |
through 3.4.4-18 | None known |
libsoupDebian:14 |
All versions, plus listed versions 2.1.2-12.1.5-12.1.7-12.2.100-12.2.101-1 Show 30 moreShow less2.2.102-12.2.103-12.2.104-12.2.105-12.2.105-22.2.105-32.2.105-42.2.2-12.2.3-12.2.3-22.2.3-2sarge12.2.6-12.2.7-12.2.7-22.2.91-12.2.91-22.2.92-12.2.93-12.2.93-22.2.93-32.2.95.1-12.2.96-12.2.97-12.2.98-12.2.98-22.2.98-2+etch12.2.99-13.8.0-53.8.0-63.8.1-1 |
None known |
libsoup2.4Debian:12 |
All versions, plus listed versions 2.74.3-12.74.3-1+deb12u12.74.3-102.74.3-10.12.74.3-11 Show 11 moreShow less2.74.3-22.74.3-32.74.3-3.1~exp12.74.3-3.1~exp22.74.3-3.1~exp32.74.3-52.74.3-62.74.3-72.74.3-82.74.3-8.12.74.3-9 |
None known |
libsoup2.4Debian:13 |
All versions, plus listed versions 2.74.3-10.12.74.3-11 |
None known |
libsoup3Debian:12 |
All versions, plus listed versions 3.2.2-23.2.3-0+deb12u13.2.3-0+deb12u23.3.1-13.4.0-1 Show 33 moreShow less3.4.1-13.4.2-13.4.2-23.4.2-33.4.2-43.4.3-13.4.4-13.4.4-23.4.4-33.4.4-43.4.4-53.5.2-13.6.0-13.6.0-23.6.0-33.6.0-43.6.1-13.6.4-13.6.4-23.6.4-33.6.5-13.6.5-23.6.5-33.6.5-43.6.5-53.6.5-63.6.5-73.6.5-83.6.5-93.6.6-13.8.0-13.8.0-23.8.0-3 |
None known |
libsoup3Debian:13 |
All versions, plus listed versions 3.6.5-33.6.5-43.6.5-53.6.5-63.6.5-7 Show 6 moreShow less3.6.5-83.6.5-93.6.6-13.8.0-13.8.0-23.8.0-3 |
None known |
libsoup3Red Hat:enterprise_linux:10.0 |
before 0:3.6.5-3.el10_0.6 | 0:3.6.5-3.el10_0.6 |
libsoup3-debuginfoRed Hat:enterprise_linux:10.0 |
before 0:3.6.5-3.el10_0.6 | 0:3.6.5-3.el10_0.6 |
Show 19 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libsoup3-debugsourceRed Hat:enterprise_linux:10.0 |
before 0:3.6.5-3.el10_0.6 | 0:3.6.5-3.el10_0.6 |
libsoup3-develRed Hat:enterprise_linux:10.0 |
before 0:3.6.5-3.el10_0.6 | 0:3.6.5-3.el10_0.6 |
libsoup3-docRed Hat:enterprise_linux:10.0 |
before 0:3.6.5-3.el10_0.6 | 0:3.6.5-3.el10_0.6 |
libsoup3Rocky Linux:10 |
before 0:3.6.5-3.el10_0.6 | 0:3.6.5-3.el10_0.6 |
libsoup3Root:Debian:13 |
before 3.6.5-3.aikido.4 | 3.6.5-3.aikido.43.6.5-3.aikido.33.6.5-3.root.io.23.6.5-3.aikido.53.6.5-3.aikido.63.6.5-3.aikido.73.6.5-3.aikido.8 |
rootio-libsoup3Root:Debian:13 |
before 3.6.5-3.aikido.4 | 3.6.5-3.aikido.43.6.5-3.aikido.33.6.5-3.root.io.23.6.5-3.aikido.53.6.5-3.aikido.63.6.5-3.aikido.73.6.5-3.aikido.8 |
libsoup2.4Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.50.0-2debian12.52.1-12.52.2-12.52.2-1ubuntu0.12.52.2-1ubuntu0.2 Show 10 moreShow less2.52.2-1ubuntu0.32.52.2-1ubuntu0.3+esm12.52.2-1ubuntu0.3+esm22.52.2-1ubuntu0.3+esm32.52.2-1ubuntu0.3+esm42.52.2-1ubuntu0.3+esm52.52.2-1ubuntu0.3+esm62.52.2-1ubuntu0.3+esm72.52.2-1ubuntu0.3+esm82.52.2-1ubuntu0.3+esm9 |
None known |
libsoup2.4Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.60.1-12.60.2-12.60.2-22.60.3-12.61.90-1 Show 15 moreShow less2.62.0-12.62.1-12.62.1-1ubuntu0.12.62.1-1ubuntu0.32.62.1-1ubuntu0.42.62.1-1ubuntu0.4+esm12.62.1-1ubuntu0.4+esm22.62.1-1ubuntu0.4+esm32.62.1-1ubuntu0.4+esm42.62.1-1ubuntu0.4+esm52.62.1-1ubuntu0.4+esm62.62.1-1ubuntu0.4+esm72.62.1-1ubuntu0.4+esm82.62.1-1ubuntu0.4+esm92.62.1-1ubuntu0.4+esm10 |
None known |
libsoup2.4Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.68.2-0ubuntu12.68.2-12.68.2-22.68.2-2build22.69.90-1 Show 11 moreShow less2.70.0-12.70.0-1ubuntu0.12.70.0-1ubuntu0.22.70.0-1ubuntu0.32.70.0-1ubuntu0.42.70.0-1ubuntu0.52.70.0-1ubuntu0.5+esm12.70.0-1ubuntu0.5+esm22.70.0-1ubuntu0.5+esm32.70.0-1ubuntu0.5+esm42.70.0-1ubuntu0.5+esm5 |
None known |
libsoup2.4Ubuntu:22.04:LTS |
All versions, plus listed versions 2.72.0-3ubuntu32.74.1-12.74.2-22.74.2-32.74.2-3ubuntu0.1 Show 9 moreShow less2.74.2-3ubuntu0.22.74.2-3ubuntu0.32.74.2-3ubuntu0.42.74.2-3ubuntu0.52.74.2-3ubuntu0.62.74.2-3ubuntu0.72.74.2-3ubuntu0.82.74.2-3ubuntu0.92.74.2-3ubuntu0.10 |
None known |
libsoup3Ubuntu:Pro:22.04:LTS |
All versions, plus listed versions 3.0.4-23.0.4-33.0.5-13.0.7-0ubuntu13.0.7-0ubuntu1+esm1 Show 9 moreShow less3.0.7-0ubuntu1+esm23.0.7-0ubuntu1+esm33.0.7-0ubuntu1+esm43.0.7-0ubuntu1+esm53.0.7-0ubuntu1+esm63.0.7-0ubuntu1+esm73.0.7-0ubuntu1+esm83.0.7-0ubuntu1+esm93.0.7-0ubuntu1+esm10 |
None known |
libsoup2.4Ubuntu:24.04:LTS |
All versions, plus listed versions 2.74.3-12.74.3-22.74.3-32.74.3-62.74.3-6build1 Show 11 moreShow less2.74.3-6ubuntu12.74.3-6ubuntu1.12.74.3-6ubuntu1.22.74.3-6ubuntu1.32.74.3-6ubuntu1.42.74.3-6ubuntu1.52.74.3-6ubuntu1.62.74.3-6ubuntu1.72.74.3-6ubuntu1.82.74.3-6ubuntu1.92.74.3-6ubuntu1.10 |
None known |
libsoup3Ubuntu:24.04:LTS |
All versions, plus listed versions 3.4.2-43.4.4-13.4.4-23.4.4-43.4.4-5 Show 12 moreShow less3.4.4-5build13.4.4-5build23.4.4-5ubuntu0.13.4.4-5ubuntu0.23.4.4-5ubuntu0.33.4.4-5ubuntu0.43.4.4-5ubuntu0.53.4.4-5ubuntu0.63.4.4-5ubuntu0.73.4.4-5ubuntu0.83.4.4-5ubuntu0.93.4.4-5ubuntu0.10 |
None known |
libsoup2.4Ubuntu:25.10 |
All versions, plus listed versions 2.74.3-102.74.3-10.12.74.3-10.1ubuntu12.74.3-10.1ubuntu22.74.3-10.1ubuntu32.74.3-10.1ubuntu42.74.3-10.1ubuntu4.1 |
None known |
libsoup3Ubuntu:25.10 |
All versions, plus listed versions 3.6.5-13.6.5-1ubuntu13.6.5-33.6.5-43.6.5-4ubuntu0.13.6.5-4ubuntu0.2 |
None known |
libsoup2.4Ubuntu:26.10 |
All versions, plus listed versions 2.74.3-10.1ubuntu5 |
None known |
libsoup3Ubuntu:26.10 |
All versions, plus listed versions 3.6.6-13.6.6-1ubuntu33.6.6-1ubuntu3.1 |
None known |
libsoup3Ubuntu:26.04:LTS |
All versions, plus listed versions 3.6.5-43.6.5-53.6.5-63.6.5-73.6.5-93.6.6-13.6.6-1ubuntu0.13.6.6-1ubuntu0.2 |
None known |
libsoup2.4Ubuntu:Pro:26.04:LTS |
All versions, plus listed versions 2.74.3-10.1ubuntu42.74.3-10.1ubuntu52.74.3-10.1ubuntu5+esm12.74.3-10.1ubuntu5+esm22.74.3-10.1ubuntu5+esm32.74.3-10.1ubuntu5+esm4 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected, facts | OSV |
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
access.redhat.com/errata/RHSA-2025:8128
bugzilla.redhat.com/show_bug.cgi?id=2362651
gitlab.gnome.org/GNOME/libsoup/-/issues/443
nvd.nist.gov/vuln/detail/CVE-2025-4035
Show 28 moreShow less
github.com/advisories/GHSA-9685-44wp-34gm
errata.almalinux.org/10/ALSA-2025-8128.html
security-tracker.debian.org/tracker/CVE-2025-4035
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8128.json
cve.org/CVERecord?id=CVE-2025-4035
errata.rockylinux.org/RLSA-2025:8128
ubuntu.com/security/CVE-2025-4035