Skip to content
Fencer Vulns
medium 4.3

CVE-2025-4035 json

Libsoup: cookie domain validation bypass via uppercase characters in libsoup

published 2025-04-29 18 mo ago modified 2026-11-05 3 d ago also EUVD-2025-15014

cvss
4.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits
0
none known

Summary

A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:3.6.5-3.el10_0.6
  • libsoup3 RHEL 10.0 3.6.5-3.el10_0.6

red hat advisories RHSA-2025:8128

  • libsoup3 Rocky Linux 10 3.6.5-3.el10_0.6

rocky linux advisories RLSA-2025:8128

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-4035 updated cvss 4.3

libsoup: Cookie domain validation bypass via uppercase characters in libsoup

  • Red Hat Enterprise Linux 6 libsoup Red Hat Enterprise Linux 7 libsoup Red Hat Enterprise Linux 8 libsoup Red Hat Enterprise Linux 9 libsoup
    affected: no fix available “Fix deferred”
  • Red Hat Enterprise Linux AppStream (v. 10) libsoup3 3.6.5-3.el10_0.6 Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libsoup3-doc 3.6.5-3.el10_0.6
    fixed: vendor fix RHSA-2025:8128

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • gitlab.gnome.org https://gitlab.gnome.org/GNOME/libsoup/-/work_items/443 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9

Classification

Weakness
  • CWE-178 Improper Handling of Case Sensitivity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.