CVE-2025-9901
MEDIUM EPSS 34.2%
Published Sep 3, 202510mo ago · Modified Jun 17, 20261w ago
5.9 CVSS 3.1
Published Sep 3, 2025 10mo ago
Last Modified Jun 17, 2026 1w ago
Description
A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information. While the issue is unlikely to affect everyday desktop use, it could result in confidentiality breaches in proxy or multi-user environments.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None
Threat Intelligence
EPSS Exploit Probability
34.2% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-524
References 3
- access.redhat.com https://access.redhat.com/security/cve/CVE-2025-9901
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2392790
- gitlab.gnome.org https://gitlab.gnome.org/GNOME/libsoup/-/issues/453
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.