CVE-2025-9901
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A flaw was found in libsoup's caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information.
Risk Assessment
The risk involves potential confidentiality breaches in proxy or multi-user environments where cached responses may be served to unauthorized users. While unlikely in typical desktop use, this issue could lead to information leakage in specific configurations.
Recommendation
It is recommended to update the libsoup library to a version containing the fix for this vulnerability. In proxy or multi-user environments, consider temporarily disabling SoupCache caching until the update is applied.
Original NVD description (English source)
A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information. While the issue is unlikely to affect everyday desktop use, it could result in confidentiality breaches in proxy or multi-user environments.