Red Hat Security Advisory

RHSA-2026:1509

spice-client-win security update

Released 2026-01-28 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) spice-client-win-8.10-6.el8_10.1, spice-client-win-x64-8.10-6.el8_10.1, spice-client-win-x86-8.10-6.el8_10.1

TI-2025-13266 CVE-2025-14523 · GHSA-4qpp-gxm3-h9vw

MEDIUM 42

A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00544 Published 2025-12-11 Partial fix · 3.6.5-3.el10_1.8, 3.6.5-3.el10_0.11 +16 CWE-444