CVE-2025-9901 Libsoup: improper handling of http vary header in libsoup caching
Attackers can access sensitive cached data across different users in proxy or multi-user environments due to improper handling of the HTTP Vary header in libsoup.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-9901?
CVE-2025-9901 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, published on 3 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information. While the issue is unlikely to affect everyday desktop use, it could result in confidentiality breaches in proxy or multi-user environments.
Weakness: CWE-524
Which versions are affected by CVE-2025-9901?
How do I fix CVE-2025-9901?
No fix has been published for CVE-2025-9901 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-9901 being exploited?
There is no known exploitation of CVE-2025-9901 in the wild and no public exploit code.
Sources
Also known as AZL-67058, AZL-67061, DEBIAN-CVE-2025-9901, GHSA-hxjp-2xf5-wmrj, UBUNTU-CVE-2025-9901.