Read the docs
TI-2025-13266 Aliases CVE-2025-14523GHSA-4qpp-gxm3-h9vw

Libsoup: libsoup: duplicate host header handling causes host-parsing discrepancy (first- vs last-value wins)

Priority MEDIUM 42CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · High · None
Fix status
Partial Red Hat: 28 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the backend interprets it as destined for another host. This discrepancy enables request-smuggling style attacks, cache poisoning, or bypassing host-based access controls when an attacker supplies duplicate Host headers.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00544 45th percentileScored 2026-11-07
Fix Partial Red Hat: 18 advisoriesRed Hat: 28 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Enterprise Linux 10—3.6.5-3.el10_1.8Patch availableCNA
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—3.6.5-3.el10_0.11Patch availableCNA
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support—2.62.2-10.el7_9Patch availableCNA
Red HatRed Hat Enterprise Linux 8—2.62.3-11.el8_10Patch availableCNA
Red HatRed Hat Enterprise Linux 8—8.10-6.el8_10.1Patch availableCNA
Red HatRed Hat Enterprise Linux 8—2.62.3-11.el8_10Patch availableCNA
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support—2.62.3-1.el8_2.7Patch availableCNA
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support—8.10-6.el8_2.1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—2.62.3-2.el8_4.7Patch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—8.10-6.el8_4.1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On—2.62.3-2.el8_4.7Patch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On—8.10-6.el8_4.1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—2.62.3-2.el8_6.7Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—8.10-6.el8_6.1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Service—2.62.3-2.el8_6.7Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Service—8.10-6.el8_6.1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions—2.62.3-2.el8_6.7Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions—8.10-6.el8_6.1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service—2.62.3-3.el8_8.7Patch availableCNA
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service—8.10-6.el8_8.1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions—2.62.3-3.el8_8.7Patch availableCNA
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions—8.10-6.el8_8.1Patch availableCNA
Red HatRed Hat Enterprise Linux 9—2.72.0-12.el9_7.3Patch availableCNA
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutions—2.72.0-8.el9_0.8Patch availableCNA
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—2.72.0-8.el9_2.8Patch availableCNA
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support—2.72.0-8.el9_4.8Patch availableCNA
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—2.72.0-10.el9_6.5Patch availableCNA
Red HatRed Hat Enterprise Linux 6——No fix listedCNA
  • Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 3.6.5-3.el10_1.8 Patch available CNA
  • Red Hat Enterprise Linux 10.0 Extended Update Support VendorRed Hat Affected — Fixed in 3.6.5-3.el10_0.11 Patch available CNA
  • Red Hat Enterprise Linux 7 Extended Lifecycle Support VendorRed Hat Affected — Fixed in 2.62.2-10.el7_9 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 2.62.3-11.el8_10 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 8.10-6.el8_10.1 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 2.62.3-11.el8_10 Patch available CNA
  • Red Hat Enterprise Linux 8.2 Advanced Update Support VendorRed Hat Affected — Fixed in 2.62.3-1.el8_2.7 Patch available CNA
  • Red Hat Enterprise Linux 8.2 Advanced Update Support VendorRed Hat Affected — Fixed in 8.10-6.el8_2.1 Patch available CNA
  • Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 2.62.3-2.el8_4.7 Patch available CNA
  • Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 8.10-6.el8_4.1 Patch available CNA
  • Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On VendorRed Hat Affected — Fixed in 2.62.3-2.el8_4.7 Patch available CNA
  • Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On VendorRed Hat Affected — Fixed in 8.10-6.el8_4.1 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 2.62.3-2.el8_6.7 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 8.10-6.el8_6.1 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Telecommunications Update Service VendorRed Hat Affected — Fixed in 2.62.3-2.el8_6.7 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Telecommunications Update Service VendorRed Hat Affected — Fixed in 8.10-6.el8_6.1 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2.62.3-2.el8_6.7 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 8.10-6.el8_6.1 Patch available CNA
  • Red Hat Enterprise Linux 8.8 Telecommunications Update Service VendorRed Hat Affected — Fixed in 2.62.3-3.el8_8.7 Patch available CNA
  • Red Hat Enterprise Linux 8.8 Telecommunications Update Service VendorRed Hat Affected — Fixed in 8.10-6.el8_8.1 Patch available CNA
  • Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2.62.3-3.el8_8.7 Patch available CNA
  • Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 8.10-6.el8_8.1 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2.72.0-12.el9_7.3 Patch available CNA
  • Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2.72.0-8.el9_0.8 Patch available CNA
  • Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2.72.0-8.el9_2.8 Patch available CNA
  • Red Hat Enterprise Linux 9.4 Extended Update Support VendorRed Hat Affected — Fixed in 2.72.0-8.el9_4.8 Patch available CNA
  • Red Hat Enterprise Linux 9.6 Extended Update Support VendorRed Hat Affected — Fixed in 2.72.0-10.el9_6.5 Patch available CNA
  • Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA

CPE names CNA · 27

CPEVersionsRoleVendor
cpe:/o:redhat:enterprise_linux:10.110.1—Red Hat
cpe:/o:redhat:enterprise_linux_eus:10.010.0—Red Hat
cpe:/o:redhat:rhel_els:77—Red Hat
cpe:/a:redhat:enterprise_linux:8::appstream8—Red Hat
cpe:/o:redhat:enterprise_linux:8::baseos8—Red Hat
cpe:/a:redhat:rhel_aus:8.2::appstream8.2—Red Hat
cpe:/o:redhat:rhel_aus:8.2::baseos8.2—Red Hat
cpe:/a:redhat:rhel_aus:8.4::appstream8.4—Red Hat
cpe:/a:redhat:rhel_eus_long_life:8.4::appstream8.4—Red Hat
cpe:/o:redhat:rhel_aus:8.4::baseos8.4—Red Hat
  • cpe:/o:redhat:enterprise_linux:10.1 Versions 10.1 — ·Red Hat
  • cpe:/o:redhat:enterprise_linux_eus:10.0 Versions 10.0 — ·Red Hat
  • cpe:/o:redhat:rhel_els:7 Versions 7 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:8::appstream Versions 8 — ·Red Hat
  • cpe:/o:redhat:enterprise_linux:8::baseos Versions 8 — ·Red Hat
  • cpe:/a:redhat:rhel_aus:8.2::appstream Versions 8.2 — ·Red Hat
  • cpe:/o:redhat:rhel_aus:8.2::baseos Versions 8.2 — ·Red Hat
  • cpe:/a:redhat:rhel_aus:8.4::appstream Versions 8.4 — ·Red Hat
  • cpe:/a:redhat:rhel_eus_long_life:8.4::appstream Versions 8.4 — ·Red Hat
  • cpe:/o:redhat:rhel_aus:8.4::baseos Versions 8.4 — ·Red Hat
Show 17 more CPE
CPEVersionsRoleVendor
cpe:/o:redhat:rhel_eus_long_life:8.4::baseos8.4—Red Hat
cpe:/a:redhat:rhel_aus:8.6::appstream8.6—Red Hat
cpe:/a:redhat:rhel_e4s:8.6::appstream8.6—Red Hat
cpe:/a:redhat:rhel_tus:8.6::appstream8.6—Red Hat
cpe:/o:redhat:rhel_aus:8.6::baseos8.6—Red Hat
cpe:/o:redhat:rhel_e4s:8.6::baseos8.6—Red Hat
cpe:/o:redhat:rhel_tus:8.6::baseos8.6—Red Hat
cpe:/a:redhat:rhel_e4s:8.8::appstream8.8—Red Hat
cpe:/a:redhat:rhel_tus:8.8::appstream8.8—Red Hat
cpe:/o:redhat:rhel_e4s:8.8::baseos8.8—Red Hat
cpe:/o:redhat:rhel_tus:8.8::baseos8.8—Red Hat
cpe:/a:redhat:enterprise_linux:9::appstream9—Red Hat
cpe:/a:redhat:rhel_e4s:9.0::appstream9.0—Red Hat
cpe:/a:redhat:rhel_e4s:9.2::appstream9.2—Red Hat
cpe:/a:redhat:rhel_eus:9.4::appstream9.4—Red Hat
cpe:/a:redhat:rhel_eus:9.6::appstream9.6—Red Hat
cpe:/o:redhat:rhel_els:66—Red Hat
  • cpe:/o:redhat:rhel_eus_long_life:8.4::baseos Versions 8.4 — ·Red Hat
  • cpe:/a:redhat:rhel_aus:8.6::appstream Versions 8.6 — ·Red Hat
  • cpe:/a:redhat:rhel_e4s:8.6::appstream Versions 8.6 — ·Red Hat
  • cpe:/a:redhat:rhel_tus:8.6::appstream Versions 8.6 — ·Red Hat
  • cpe:/o:redhat:rhel_aus:8.6::baseos Versions 8.6 — ·Red Hat
  • cpe:/o:redhat:rhel_e4s:8.6::baseos Versions 8.6 — ·Red Hat
  • cpe:/o:redhat:rhel_tus:8.6::baseos Versions 8.6 — ·Red Hat
  • cpe:/a:redhat:rhel_e4s:8.8::appstream Versions 8.8 — ·Red Hat
  • cpe:/a:redhat:rhel_tus:8.8::appstream Versions 8.8 — ·Red Hat
  • cpe:/o:redhat:rhel_e4s:8.8::baseos Versions 8.8 — ·Red Hat
  • cpe:/o:redhat:rhel_tus:8.8::baseos Versions 8.8 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
  • cpe:/a:redhat:rhel_e4s:9.0::appstream Versions 9.0 — ·Red Hat
  • cpe:/a:redhat:rhel_e4s:9.2::appstream Versions 9.2 — ·Red Hat
  • cpe:/a:redhat:rhel_eus:9.4::appstream Versions 9.4 — ·Red Hat
  • cpe:/a:redhat:rhel_eus:9.6::appstream Versions 9.6 — ·Red Hat
  • cpe:/o:redhat:rhel_els:6 Versions 6 — ·Red Hat

Remediation

Red Hat 18 advisories

  • RHSA-2026:1569 Released 2026-01-29 · Red Hat rating Important
    spice-client-win security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) spice-client-win-8.10-6.el8_8.1, spice-client-win-x64-8.10-6.el8_8.1, spice-client-win-x86-8.10-6.el8_8.1
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) spice-client-win-8.10-6.el8_8.1, spice-client-win-x64-8.10-6.el8_8.1, spice-client-win-x86-8.10-6.el8_8.1
  • RHSA-2026:1570 Released 2026-01-29 · Red Hat rating Important
    spice-client-win security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) spice-client-win-8.10-6.el8_6.1, spice-client-win-x64-8.10-6.el8_6.1, spice-client-win-x86-8.10-6.el8_6.1
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) spice-client-win-8.10-6.el8_6.1, spice-client-win-x64-8.10-6.el8_6.1, spice-client-win-x86-8.10-6.el8_6.1
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) spice-client-win-8.10-6.el8_6.1, spice-client-win-x64-8.10-6.el8_6.1, spice-client-win-x86-8.10-6.el8_6.1
  • RHSA-2026:1572 Released 2026-01-29 · Red Hat rating Important
    spice-client-win security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) spice-client-win-8.10-6.el8_4.1, spice-client-win-x64-8.10-6.el8_4.1, spice-client-win-x86-8.10-6.el8_4.1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) spice-client-win-8.10-6.el8_4.1, spice-client-win-x64-8.10-6.el8_4.1, spice-client-win-x86-8.10-6.el8_4.1
Show 15 more Red Hat advisories
  • RHSA-2026:1571 Released 2026-01-29 · Red Hat rating Important
    spice-client-win security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) spice-client-win-8.10-6.el8_2.1, spice-client-win-x64-8.10-6.el8_2.1, spice-client-win-x86-8.10-6.el8_2.1
  • RHSA-2026:1509 Released 2026-01-28 · Red Hat rating Important
    spice-client-win security update
    • Red Hat Enterprise Linux AppStream (v. 8) spice-client-win-8.10-6.el8_10.1, spice-client-win-x64-8.10-6.el8_10.1, spice-client-win-x86-8.10-6.el8_10.1
  • RHSA-2026:0925 Released 2026-01-21 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) libsoup-2.62.2-10.el7_9, libsoup-2.62.2-10.el7_9.ppc, libsoup-devel-2.62.2-10.el7_9 +1
  • RHSA-2026:0911 Released 2026-01-21 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) libsoup-devel-2.62.3-1.el8_2.7
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) libsoup-2.62.3-1.el8_2.7
  • RHSA-2026:0908 Released 2026-01-21 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) libsoup-2.72.0-8.el9_4.8, libsoup-devel-2.72.0-8.el9_4.8
  • RHSA-2026:0907 Released 2026-01-21 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) libsoup-2.72.0-10.el9_6.5, libsoup-devel-2.72.0-10.el9_6.5
  • RHSA-2026:0905 Released 2026-01-21 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) libsoup-devel-2.62.3-2.el8_6.7
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) libsoup-devel-2.62.3-2.el8_6.7
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) libsoup-devel-2.62.3-2.el8_6.7
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) libsoup-2.62.3-2.el8_6.7
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) libsoup-2.62.3-2.el8_6.7
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) libsoup-2.62.3-2.el8_6.7
  • RHSA-2026:0906 Released 2026-01-21 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) libsoup-2.72.0-8.el9_0.8, libsoup-devel-2.72.0-8.el9_0.8
  • RHSA-2026:0909 Released 2026-01-21 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) libsoup-devel-2.62.3-2.el8_4.7
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) libsoup-devel-2.62.3-2.el8_4.7
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) libsoup-2.62.3-2.el8_4.7
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) libsoup-2.62.3-2.el8_4.7
  • RHSA-2026:0867 Released 2026-01-20 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) libsoup-devel-2.62.3-3.el8_8.7
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) libsoup-devel-2.62.3-3.el8_8.7
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) libsoup-2.62.3-3.el8_8.7
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) libsoup-2.62.3-3.el8_8.7
  • RHSA-2026:0868 Released 2026-01-20 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) libsoup-2.72.0-8.el9_2.8, libsoup-devel-2.72.0-8.el9_2.8
  • RHSA-2026:0836 Released 2026-01-20 · Red Hat rating Important
    libsoup3 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) libsoup3-3.6.5-3.el10_0.11, libsoup3-devel-3.6.5-3.el10_0.11
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) libsoup3-doc-3.6.5-3.el10_0.11
  • RHSA-2026:0422 Released 2026-01-12 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream (v. 9) libsoup-2.72.0-12.el9_7.3, libsoup-devel-2.72.0-12.el9_7.3
  • RHSA-2026:0421 Released 2026-01-12 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream (v. 8) libsoup-devel-2.62.3-11.el8_10
    • Red Hat Enterprise Linux BaseOS (v. 8) libsoup-2.62.3-11.el8_10
  • RHSA-2026:0423 Released 2026-01-12 · Red Hat rating Important
    libsoup3 security update
    • Red Hat Enterprise Linux AppStream (v. 10) libsoup3-3.6.5-3.el10_1.8, libsoup3-devel-3.6.5-3.el10_1.8
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libsoup3-doc-3.6.5-3.el10_1.8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:0423
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:0421, RHSA-2026:1509
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:0422
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2026:0911, RHSA-2026:1571
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:0909, RHSA-2026:1572
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:0905, RHSA-2026:1570
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2026:0905, RHSA-2026:1570
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:0867, RHSA-2026:1569
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:0906
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:0868
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:0836
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:0908
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:0907
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:0909, RHSA-2026:1572
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2026:0905, RHSA-2026:1570
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:0867, RHSA-2026:1569
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:0421
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2026:0911
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2026:0909
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:0905
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2026:0905
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:0867
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2026:0909
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2026:0905
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:0867
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:0423
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:0836
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2026:0925

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-14523
  2. 2026-10-03 Alias added: GHSA-4qpp-gxm3-h9vw

References

Advisory 18

Other 3

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences