CVE-2025-4035: libsoup2.4 Improper Handling of Case Sensitivity
Vulnerability summary
CVE-2025-4035 is a medium (CVSS 4.3) Improper Handling of Case Sensitivity vulnerability in libsoup2.4. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 36.7% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 29-04-2025PublishedVulnerability first disclosed.
- 30-06-2026Last modifiedVulnerability information updated.
Description
A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.44%
Chance of exploitation in the next 30 days
Percentile
37%
Versus all other CVEs
30-day change
+0.02 pp
From 0.42% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (gitlab.gnome.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian2 products
- libsoup2.4All versions (No fix recorded)
- libsoup3All versions (No fix recorded)
Ubuntu2 products
- libsoup2.4All versions (No fix recorded)
- libsoup3All versions (No fix recorded)
2 vendors · 4 products
