Red Hat Security Advisory

RHSA-2026:0909

libsoup security update

Released 2026-01-21 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream AUS (v.8.4) libsoup-devel-2.62.3-2.el8_4.7
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) libsoup-devel-2.62.3-2.el8_4.7
Red Hat Enterprise Linux BaseOS AUS (v.8.4) libsoup-2.62.3-2.el8_4.7
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) libsoup-2.62.3-2.el8_4.7

TI-2025-13266 CVE-2025-14523 · GHSA-4qpp-gxm3-h9vw

MEDIUM 42

A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00544 Published 2025-12-11 Partial fix · 3.6.5-3.el10_1.8, 3.6.5-3.el10_0.11 +16 CWE-444