CVE-2025-11021: Libsoup: out-of-bounds read in cookie date handling of libsoup http library
A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communication. When processing cookies with specially crafted expiration dates, the library may perform an out-of-bounds memory read. This flaw could result in unintended disclosure of memory contents, potentially exposing sensitive information from the process using libsoup.
Other sources
Libsoup: out-of-bounds read in cookie date handling of libsoup http library
— Microsoft
Out-of-Bounds Read vulnerability in the cookie date handling code of the libsoup HTTP library. The flaw is caused by improper bounds checking in the soupdatetimetostring() function when formatting crafted cookie expiration dates. An attacker can exploit this by sending specially crafted HTTP cookies, potentially leading to unintended memory disclosure. In production builds, the impact is expected to be limited to incorrect output rather than consistent crashes.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11021?
CVE-2025-11021 has been classified as a high severity vulnerability due to its potential for causing out-of-bounds memory reads.
How do I fix CVE-2025-11021?
To fix CVE-2025-11021, update your GNOME libsoup library to the latest patched version provided by your distribution.
What systems are affected by CVE-2025-11021?
CVE-2025-11021 affects systems using the libsoup HTTP library, commonly found in GNOME applications.
What are the potential impacts of CVE-2025-11021?
The potential impact of CVE-2025-11021 includes unauthorized access to memory sections, which could lead to crashes or data leakage.
Is there a workaround for CVE-2025-11021?
While no official workaround exists, it's advisable to avoid using affected applications until the vulnerability is patched.