CVE-2025-4035
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A flaw was found in the libsoup library in cookie handling. libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own.
Risk Assessment
The risk for the organization includes potential integrity issues such as session fixation attacks. This could lead to session hijacking and unauthorized access to resources.
Recommendation
It is recommended to immediately update the libsoup library to a patched version. Also review cookie handling configuration in applications using libsoup.
Original NVD description (English source)
A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation.