Red Hat Security Advisory

RHSA-2026:0907

libsoup security update

Released 2026-01-21 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v.9.6) libsoup-2.72.0-10.el9_6.5, libsoup-devel-2.72.0-10.el9_6.5

TI-2025-13266 CVE-2025-14523 · GHSA-4qpp-gxm3-h9vw

MEDIUM 42

A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00544 Published 2025-12-11 Partial fix · 3.6.5-3.el10_1.8, 3.6.5-3.el10_0.11 +16 CWE-444