CVE-2025-14523: GNOME libsoup HTTP request smuggling via duplicate Host headers

CVE-2025-14523 · Severity: high · CVSS 8.2 · Published 2025-12-11

libsoup is a widely used software library that helps applications communicate over the internet. A flaw in how it handles web requests allows an attacker to send conflicting information about which website they are trying to reach. This can trick security filters and web proxies into sending traffic to the wrong destination, potentially allowing unauthorized access to restricted data or the corruption of web caches.

Technologies: Gnome Libsoup, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9. Vendors: Gnome, Red Hat.

Quick answers

Is CVE-2025-14523 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-14523 being exploited in the wild.
How severe is CVE-2025-14523?
High severity, with a CVSS score of 8.2, published 11 December 2025.
Which products and versions are affected?
Gnome Libsoup 2.x, 3.x; Red Hat Enterprise Linux 10 libsoup3-3.6.5-3.el10_1.8; Red Hat Enterprise Linux 7 libsoup-2.62.2-10.el7_9; Red Hat Enterprise Linux 8 libsoup-2.62.3-11.el8_10; and 1 more.
Is there a fix for CVE-2025-14523?
A patch was published on 2026-01-12: Red Hat released initial security advisories. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-14523 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-14523?
Check whether you run Gnome Libsoup, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in libsoup's HTTP header parsing logic where the library incorrectly handles multiple 'Host' headers by prioritizing the last occurrence. This behavior creates a discrepancy when libsoup is used behind front-end proxies or load balancers that typically honor only the first 'Host' header. An unauthenticated remote attacker can exploit this inconsistency to perform HTTP request smuggling, virtual host (vhost) confusion, or web cache poisoning. By supplying duplicate Host headers, attackers may bypass host-based access controls or route requests to unintended backend services. Red Hat has released security updates (e.g., RHSA-2026:0421, RHSA-2026:0422) to address this issue across various RHEL versions.

Affected products

  • GNOME libsoup 2.x, 3.x
  • Red Hat Red Hat Enterprise Linux 7 libsoup-2.62.2-10.el7_9
  • Red Hat Red Hat Enterprise Linux 8 libsoup-2.62.3-11.el8_10
  • Red Hat Red Hat Enterprise Linux 9 libsoup-2.72.0-12.el9_7.3
  • Red Hat Red Hat Enterprise Linux 10 libsoup3-3.6.5-3.el10_1.8

Timeline

  • 2025-12-11: disclosed
  • 2026-01-12: patched: Red Hat released initial security advisories.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.