CVE-2025-4035 Libsoup: cookie domain validation bypass via uppercase characters in libsoup
Attackers can bypass public suffix protections to set cookies for unauthorized domains, enabling session fixation attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-4035?
CVE-2025-4035 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, published on 29 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation.
Weakness: CWE-178
Which versions are affected by CVE-2025-4035?
How do I fix CVE-2025-4035?
Apply the vendor's patch.
Is CVE-2025-4035 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-4035 exists.
Sources
Also known as AZL-61665, AZL-61670, DEBIAN-CVE-2025-4035, ECHO-bb6e-a23a-d95a, GHSA-9685-44wp-34gm, ROOT-OS-DEBIAN-13-CVE-2025-4035 and 1 more.