CVE-2025-4035: Libsoup: cookie domain validation bypass via uppercase characters in libsoup
A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation.
Other sources
Libsoup: cookie domain validation bypass via uppercase characters in libsoup
— Microsoft
When handling cookies, libsoup clients improperly validate domain names containing uppercase characters, allowing malicious websites to set cookies for public suffix domains and bypass expected isolation boundaries.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4035?
CVE-2025-4035 is considered a medium severity vulnerability due to its potential to bypass public suffix domain protections.
How do I fix CVE-2025-4035?
To mitigate CVE-2025-4035, upgrade to the latest version of libsoup that addresses this vulnerability.
What kind of systems are affected by CVE-2025-4035?
CVE-2025-4035 affects systems using the GNOME libsoup library that handle cookies improperly.
What is the main issue described in CVE-2025-4035?
The main issue in CVE-2025-4035 is that libsoup allows cookies to be set for public suffix domains incorrectly.
Who should be concerned about CVE-2025-4035?
Developers and system administrators using libsoup in their applications should be concerned about CVE-2025-4035.