Executive brief
A security flaw was found in libsoup, a networking library used by many Linux applications to handle web requests. The library's caching system fails to properly distinguish between different versions of the same web page, such as those intended for different languages or specific users. In shared or proxy environments, this could lead to sensitive information being accidentally shown to the wrong person or an unauthorized user gaining access to private data.
Technical details
A vulnerability exists in libsoup's SoupCache implementation due to improper handling of the HTTP Vary header. The root cause is located in the soup_cache_has_response() function in soup-cache.c, where a 'TODO' comment indicates that the logic to validate request headers against the Vary criteria was never implemented. Consequently, the cache performs lookups based primarily on the URI, ignoring header-based variations like Accept-Language or Authorization. An attacker could exploit this in multi-user or proxy environments to trigger information disclosure or bypass authorization by receiving a cached response intended for a different user context. The issue affects applications that explicitly enable SoupCache.
Affected products
- GNOME libsoup All versions prior to fix
- Red Hat Red Hat Enterprise Linux 7 affected
- Red Hat Red Hat Enterprise Linux 8 affected
- Red Hat Red Hat Enterprise Linux 9 affected
- Red Hat Red Hat Enterprise Linux 10 affected
Timeline
- 2025-05-17: disclosed: Vulnerability reported via YesWeHack
- 2025-09-03: advisory: Initial NVD publication and Red Hat advisory