Flaw in Libsoup Caching Mechanism Affecting Red Hat Products

CVE-2025-9901

What is CVE-2025-9901?

In Libsoup, a flaw exists in its caching mechanism known as SoupCache, which improperly handles the HTTP Vary header. This oversight can lead to the reuse of cached responses across different requests without adequately varying them, particularly regarding request headers that indicate language preference or authentication status. As a result, this can inadvertently expose sensitive user information in environments such as proxies or systems with multiple users. Although it may not impact typical desktop usage, its implications raise serious confidentiality concerns in shared usage scenarios.

References