CVE-2025-9901: Libsoup: improper handling of http vary header in libsoup caching
A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information. While the issue is unlikely to affect everyday desktop use, it could result in confidentiality breaches in proxy or multi-user environments.
Other sources
Improper Cache Validation vulnerability in the SoupCache implementation of the libsoup HTTP library.The flaw is due to libsoup ignoring the HTTP Vary header when determining whether a cached response is valid for subsequent requests. This oversight occurs in the soupcachehasresponse() function, where an unimplemented check results in cached responses being reused incorrectly across different request contexts. If exploited, an attacker could cause highly sensitive or user-specific content to be served to unintended recipients, resulting in serious information disclosure. The issue is only relevant to applications that explicitly enable SoupCache, and exploitation is more plausible in proxy-like scenarios rather than standard GNOME desktop use cases.
— Red Hat
Libsoup: improper handling of http vary header in libsoup caching
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9901?
CVE-2025-9901 is considered a high severity vulnerability due to the potential for sensitive information exposure through improperly cached responses.
How do I fix CVE-2025-9901?
To fix CVE-2025-9901, update to the latest version of libsoup that has addressed this caching mechanism flaw.
What systems are affected by CVE-2025-9901?
CVE-2025-9901 affects applications using GNOME libsoup for handling HTTP requests and responses.
What impact does CVE-2025-9901 have on web applications?
CVE-2025-9901 can lead to unintended content being served to users, compromising data confidentiality and integrity.
Is there a workaround for CVE-2025-9901 until a patch is available?
As a temporary workaround for CVE-2025-9901, consider disabling caching mechanisms in your application if feasible.