SB2025121511 - HTTP request smuggling in libsoup

Description

This security bulletin contains information about 1 security vulnerability.

1) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2025-14523)

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests. libsoup accepts duplicate Host: headers and implements a last-value-wins policy when soup_message_headers_get_one[_common] is used to construct the request URI, while many proxies and routers use the first Host: header for routing. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://access.redhat.com/security/cve/CVE-2025-14523
• https://bugzilla.redhat.com/show_bug.cgi?id=2421349