CVE-2025-14523: Libsoup: libsoup: duplicate host header handling causes host-parsing discrepancy (first- vs last-value wins)

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-11 · updated 2026-10-07
Weakness: CWE-444

Description

A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the backend interprets it as destined for another host. This discrepancy enables request-smuggling style attacks, cache poisoning, or bypassing host-based access controls when an attacker supplies duplicate Host headers.

Affected products

Red Hat Enterprise Linux 10: all versions — fixed in 0:3.6.5-3.el10_1.8
Red Hat Enterprise Linux 10.0 Extended Update Support: all versions — fixed in 0:3.6.5-3.el10_0.11
Red Hat Enterprise Linux 7 Extended Lifecycle Support: all versions — fixed in 0:2.62.2-10.el7_9
Red Hat Enterprise Linux 8: all versions — fixed in 0:2.62.3-11.el8_10, 0:8.10-6.el8_10.1
Red Hat Enterprise Linux 8.2 Advanced Update Support: all versions — fixed in 0:2.62.3-1.el8_2.7, 0:8.10-6.el8_2.1
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: all versions — fixed in 0:2.62.3-2.el8_4.7, 0:8.10-6.el8_4.1
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On: all versions — fixed in 0:2.62.3-2.el8_4.7, 0:8.10-6.el8_4.1
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: all versions — fixed in 0:2.62.3-2.el8_6.7, 0:8.10-6.el8_6.1
Red Hat Enterprise Linux 8.6 Telecommunications Update Service: all versions — fixed in 0:2.62.3-2.el8_6.7, 0:8.10-6.el8_6.1
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions: all versions — fixed in 0:2.62.3-2.el8_6.7, 0:8.10-6.el8_6.1
Red Hat Enterprise Linux 8.8 Telecommunications Update Service: all versions — fixed in 0:2.62.3-3.el8_8.7, 0:8.10-6.el8_8.1
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions: all versions — fixed in 0:2.62.3-3.el8_8.7, 0:8.10-6.el8_8.1
Red Hat Enterprise Linux 9: all versions — fixed in 0:2.72.0-12.el9_7.3
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions: all versions — fixed in 0:2.72.0-8.el9_0.8
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: all versions — fixed in 0:2.72.0-8.el9_2.8
Red Hat Enterprise Linux 9.4 Extended Update Support: all versions — fixed in 0:2.72.0-8.el9_4.8
Red Hat Enterprise Linux 9.6 Extended Update Support: all versions — fixed in 0:2.72.0-10.el9_6.5

How to fix

Upgrade to a fixed version: Red Hat Enterprise Linux 10 0:3.6.5-3.el10_1.8; Red Hat Enterprise Linux 10.0 Extended Update Support 0:3.6.5-3.el10_0.11; Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:2.62.2-10.el7_9; Red Hat Enterprise Linux 8 0:2.62.3-11.el8_10, 0:8.10-6.el8_10.1; Red Hat Enterprise Linux 8.2 Advanced Update Support 0:2.62.3-1.el8_2.7, 0:8.10-6.el8_2.1; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:2.62.3-2.el8_4.7, 0:8.10-6.el8_4.1; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:2.62.3-2.el8_4.7, 0:8.10-6.el8_4.1; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:2.62.3-2.el8_6.7, 0:8.10-6.el8_6.1; Red Hat Enterprise Linux 8.6 Telecommunications Update Service 0:2.62.3-2.el8_6.7, 0:8.10-6.el8_6.1; Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 0:2.62.3-2.el8_6.7, 0:8.10-6.el8_6.1; Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:2.62.3-3.el8_8.7, 0:8.10-6.el8_8.1; Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:2.62.3-3.el8_8.7, 0:8.10-6.el8_8.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-14523 or the next vulnerability affects your stack