# CVE-2025-11021: GNOME libsoup out-of-bounds read in cookie date handling

Source: https://junglewise.ai/threats/cve-2025-11021-gnome-libsoup-out-of-bounds-read-in-cookie-date-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-26. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2025-11021 · Severity: high · CVSS 7.5 · Published 2025-09-26

A security vulnerability has been identified in libsoup, a widely used software library that allows applications to communicate over the internet. The flaw occurs when the library processes web cookies with specifically manipulated expiration dates. If exploited, this could allow an attacker to view sensitive information stored in the memory of the affected application, potentially leading to the exposure of private data or credentials.

Technologies: [Gnome Libsoup](https://junglewise.ai/threats/technologies/libsoup), [Red Hat Enterprise Linux 10](https://junglewise.ai/threats/technologies/enterprise-linux-10), [Red Hat Enterprise Linux 9](https://junglewise.ai/threats/technologies/enterprise-linux-9). Vendors: [Gnome](https://junglewise.ai/threats/vendors/gnome), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2025-11021 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-11021 being exploited in the wild.

**How severe is CVE-2025-11021?** High severity, with a CVSS score of 7.5, published 26 September 2025.

**Which products and versions are affected?** Gnome Libsoup <= 3.6.5; Red Hat Enterprise Linux 10 libsoup3 < 3.6.5-3.el10_0.7; Red Hat Enterprise Linux 9 libsoup < 2.72.0-10.el9_6.3.

**Is there a fix for CVE-2025-11021?** A patch was published on 2025-10-15: Red Hat released security updates for RHEL 10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-11021 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-11021?** Check whether you run Gnome Libsoup, Red Hat Enterprise Linux 10 or Red Hat Enterprise Linux 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability (CWE-125) exists in the cookie date handling logic of the libsoup HTTP library. The issue is triggered when the library parses a 'Set-Cookie' header containing a specially crafted expiration date string. A remote, unauthenticated attacker can exploit this by sending a malicious HTTP response to an application using libsoup. Successful exploitation allows the attacker to read sensitive information from the process's memory space. Patches have been released by GNOME and various Linux distributions including Red Hat.

## Affected products

- GNOME libsoup <= 3.6.5
- Red Hat Red Hat Enterprise Linux 10 libsoup3 < 3.6.5-3.el10_0.7
- Red Hat Red Hat Enterprise Linux 9 libsoup < 2.72.0-10.el9_6.3

## Timeline

- 2025-09-26: advisory: Initial CVE publication
- 2025-10-15: patched: Red Hat released security updates for RHEL 10

## References

- [https://gitlab.gnome.org/GNOME/libsoup/](https://gitlab.gnome.org/GNOME/libsoup/)
- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/errata/RHSA-2025:18183](https://access.redhat.com/errata/RHSA-2025:18183)
- [https://access.redhat.com/errata/RHSA-2025:19713](https://access.redhat.com/errata/RHSA-2025:19713)
- [https://access.redhat.com/errata/RHSA-2025:19714](https://access.redhat.com/errata/RHSA-2025:19714)
- [https://access.redhat.com/errata/RHSA-2025:20959](https://access.redhat.com/errata/RHSA-2025:20959)
- [https://access.redhat.com/errata/RHSA-2025:21032](https://access.redhat.com/errata/RHSA-2025:21032)

## Related threats

- [libsoup HTTP request smuggling via undrained Expect: 100-continue body](https://junglewise.ai/threats/cve-2026-103399-a-flaw-was-found-in-soupserver-libsoup-when-an-http-1-x-client)
- [libsoup heap buffer overflow in permessage-deflate WebSocket extension](https://junglewise.ai/threats/cve-2026-102560-a-flaw-was-found-in-libsoup-when-the-permessage-deflate)
- [libsoup heap buffer overflow in WebSocket handling](https://junglewise.ai/threats/cve-2026-102558-a-flaw-was-found-in-libsoup-when-max-incoming-payload-size-is)
- [libsoup out-of-bounds read in data-URI base64 decoding](https://junglewise.ai/threats/cve-2026-102555-a-flaw-was-found-in-libsoup-the-soup-uri-decode-data-uri)
- [libsoup heap corruption in WebSocket message reassembly](https://junglewise.ai/threats/cve-2026-102557-a-flaw-was-found-in-libsoup-when-reassembling-fragmented)