CVE-2025-14523: Libsoup: libsoup: duplicate host header handling causes host-parsing discrepancy (first- vs last-value wins)
A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the backend interprets it as destined for another host. This discrepancy enables request-smuggling style attacks, cache poisoning, or bypassing host-based access controls when an attacker supplies duplicate Host headers.
Other sources
libsoup accepts duplicate Host: headers and implements a last-value-wins policy when soupmessageheadersgetone[common] is used to construct the request URI, while many proxies and routers use the first Host: header for routing. The provided PoC reliably demonstrates that a proxy honoring the first Host: can route to backend A but the libsoup server will interpret the request as for host B (last header), enabling virtual-host confusion and potential bypasses of host-based ACLs or cache poisoning.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14523?
The severity of CVE-2025-14523 is classified as medium, due to the potential for vhost confusion in server-side processing.
How do I fix CVE-2025-14523?
To fix CVE-2025-14523, update to the latest version of libsoup that addresses the HTTP header handling flaw.
What systems are affected by CVE-2025-14523?
CVE-2025-14523 affects versions of libsoup where multiple Host: headers can be processed incorrectly.
What risks does CVE-2025-14523 pose?
CVE-2025-14523 poses risks of vhost confusion, potentially leading to improper routing of requests by front proxies.
Is CVE-2025-14523 being actively exploited?
As of now, there is no public indication that CVE-2025-14523 is actively exploited in the wild.