CVE-2025-11021 – This vulnerability in libsoup's cookie date han... (How to Fix)

Q: What is the severity of CVE-2025-11021?

CVE-2025-11021 has a CVSS score of 7.5 (HIGH). This vulnerability in libsoup's cookie date handling allows out-of-bounds memory reads when processing maliciously crafted cookie expiration dates. It could expose sensitive memory contents from applications using libsoup for HTTP communication. Affected systems include GNOME applications and any software relying on libsoup for web requests.

📋 TL;DR

This vulnerability in libsoup's cookie date handling allows out-of-bounds memory reads when processing maliciously crafted cookie expiration dates. It could expose sensitive memory contents from applications using libsoup for HTTP communication. Affected systems include GNOME applications and any software relying on libsoup for web requests.

💻 Affected Systems

Products:

libsoup
GNOME applications using libsoup
applications with libsoup dependency

Versions: Specific versions not provided in CVE; check Red Hat advisories for affected ranges

Operating Systems: Linux distributions with GNOME/lib-soup packages

Default Config Vulnerable: ⚠️ Yes

Notes: Any application using libsoup for HTTP client requests with cookie handling enabled is vulnerable by default.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Sensitive process memory containing credentials, session tokens, or private data could be exfiltrated to an attacker-controlled server via crafted HTTP responses.

🟠

Likely Case

Information disclosure of random memory contents, potentially including fragments of sensitive data, leading to privacy violations or aiding further attacks.

🟢

If Mitigated

Limited impact with proper network segmentation and application sandboxing, though memory exposure risk remains.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires tricking a vulnerable application into processing a malicious HTTP response with crafted cookies.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check specific Red Hat advisories for patched versions

Vendor Advisory: https://access.redhat.com/errata/RHSA-2025:18183

Restart Required: Yes

Instructions:

1. Update libsoup packages using your distribution's package manager. 2. For Red Hat systems, apply relevant RHSA patches. 3. Restart applications using libsoup.

🔧 Temporary Workarounds

Disable cookie handling

all

Configure applications to disable cookie processing if not required

Application-specific configuration; no universal command

🧯 If You Can't Patch

Network segmentation to restrict vulnerable systems from accessing untrusted HTTP servers
Use application sandboxing/containerization to limit memory exposure impact

🔍 How to Verify

Check if Vulnerable:

Check libsoup package version against patched versions in Red Hat advisories

Check Version:

rpm -q libsoup (Red Hat) or dpkg -l libsoup* (Debian/Ubuntu)

Verify Fix Applied:

Verify libsoup package is updated to patched version and applications are restarted

📡 Detection & Monitoring

Log Indicators:

Application crashes or unusual memory access errors in system logs

Network Indicators:

HTTP responses with unusually formatted cookie expiration dates

SIEM Query:

Not applicable without specific exploit signatures

📊 Metadata

CVE ID: CVE-2025-11021

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE: CWE-125

EPSS Score: 0.08% exploit probability (22.7th percentile)

Published: September 26, 2025

Last Updated: November 25, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-11021, you might also want to check these: